Claude Design MCP 403: authorization-server metadata 404s at both RFC 8414 paths

TL;DR — the authorization-server metadata exists, but only at the OIDC path:

claude.ai/.well-known/oauth-authorization-server/v1/design/mcp   404
claude.ai/v1/design/mcp/.well-known/oauth-authorization-server   404
claude.ai/v1/design/mcp/.well-known/openid-configuration         200

A client following RFC 8414 finds nothing, falls back to the retired sign-in endpoint, and surfaces a 403 that reads like an account problem. Serving the same document at the standard path fixes it.

Summary

Claude Design's MCP server advertises its authorization server. That server publishes its metadata at one location: the OpenID Connect path. Both RFC 8414 locations return 404, so OAuth discovery dead-ends.

#92215, #93381 and #94044 report the resulting 403. This issue tracks the discovery failure underneath it.

The chain

1. POST https://api.anthropic.com/v1/design/mcp returns 401 with

WWW-Authenticate: Bearer resource_metadata="https://api.anthropic.com/v1/design/.well-known/oauth-protected-resource", scope="user:design:read user:design:write" ✅

1. That metadata declares authorization_servers: ["https://claude.ai/v1/design/mcp"] ✅
2. AS metadata discovery, verified in-browser (passes Cloudflare), 2026-09-18:

https://claude.ai/.well-known/oauth-authorization-server/v1/design/mcp   404
https://claude.ai/v1/design/mcp/.well-known/oauth-authorization-server   404
https://claude.ai/v1/design/mcp/.well-known/openid-configuration         200

The 200 response carries a complete AS document:

issuer: https://claude.ai/v1/design/mcp
scopes_supported: ["user:design:read", "user:design:write"]
registration_endpoint: https://api.anthropic.com/v1/design/mcp/oauth/register
grant_types_supported: ["authorization_code", "refresh_token"], PKCE S256

Impact

Two repro paths, both on current versions:

• claude mcp add --transport http claude-design https://api.anthropic.com/v1/design/mcp fails every session with FIRST_PARTY_AUTH_REJECTED (HTTP 403)
• Adding the same URL as a custom connector at claude.ai/customize/connectors lands on a page titled "Sign-in endpoint retired" ("Your client reached this page through an outdated sign-in fallback")

Ruled out locally: claude mcp logout claude-design followed by a reconnect still returns 403, so no stale credential is involved. claude mcp login claude-design replies "authenticates automatically with your Claude login", so no separate grant exists to perform.

Suggested fix

Serve the same document at https://claude.ai/.well-known/oauth-authorization-server/v1/design/mcp (RFC 8414 §3.1 path insertion). The alternative is a client-side fallback to openid-configuration, which #41253 requested and which was closed.

Environment

Claude Code 2.1.275, claude.ai web (current), macOS 25.6.0, Max account.
Last successful Claude Design MCP call from this machine: 2026-07-09.

Related: #92215 #93381 #94044 #69496 #41253 #83681