MCP OAuth Redirect URI Errors: How to Fix Them (Claude, Claude Code, Cursor, VS Code)

An OAuth redirect error on an MCP server means the authorization server refused the callback address the MCP client sent. OAuth requires an exact match against registered redirect URIs, and each MCP client uses a different one. The fastest fix is to find the exact callback your client uses (for example https://claude.ai/api/mcp/auth_callback for claude.ai and Claude Desktop connectors), register it in your OAuth app, and try the sign-in again.

Checked against: Claude's connector authentication docs, the Claude Code MCP docs, Cursor's MCP docs, the MCP 2026-07-28 authorization security considerations and Microsoft's Power Pages MCP redirect URI guide on 2 November 2026. eSEOspace did not run sign-ins against each provider.

What this error means

When you connect a remote MCP server that uses OAuth, the client opens the provider's sign-in page and passes a redirect_uri. After you approve, the provider sends you back to that address with a code.

The MCP spec's security section requires that "MCP clients MUST have redirect URIs registered with the authorization server," and that servers validate exact URIs. If the address differs in any way (scheme, host, port, path, trailing slash), the provider shows an error such as "Invalid redirect URI" or "redirect_uri_mismatch," and the flow stops.

How the client gets registered also matters. With Dynamic Client Registration (DCR), the client registers its own redirect URIs. With a Client ID Metadata Document (CIMD), the client publishes them at a URL. With a pre-registered app, an admin must type them in. The spec's client registration page adds that desktop and CLI tools "SHOULD use application_type: "native"," because OIDC servers may otherwise apply web-app rules to a localhost redirect.

Quick fix

1. Copy the exact error. Note the redirect_uri value in the browser address bar or the provider's error page.
2. Look up your client's callback in the table below.
3. Register it exactly in your OAuth app, with the same scheme, host, port and path.
4. For loopback redirects, allow any port if your provider supports it, or fix the client's port.
5. Retry the sign-in from the client.

Fix by client / OS

Claude (claude.ai and Claude Desktop connectors)

Claude's authentication docs say to "register exactly this redirect URI": https://claude.ai/api/mcp/auth_callback. The same docs say Claude selects CIMD only when your authorization server advertises "client_id_metadata_document_supported": true and "none" in token_endpoint_auth_methods_supported; otherwise it falls back to DCR. Also check the troubleshooting cause where your MCP URL redirects to another host: Claude drops the Authorization header on that redirect.

Claude Code

The Claude Code MCP docs say Claude Code "picks a random available port for the OAuth callback." If your provider needs a fixed URI, add the server with --callback-port:

claude mcp add --transport http \
  --callback-port 8080 \
  my-server https://mcp.example.com/mcp

Then register http://localhost:8080/callback. The docs note that Claude Code v2.1.229 sent http://127.0.0.1:PORT/callback, which broke exact-match URIs, and v2.1.231 restored the localhost form. Update Claude Code if you are on the affected version. Claude's authentication docs ask server owners to match localhost and 127.0.0.1 "with the port component ignored."

Cursor

Cursor's MCP docs list the two callbacks in the table. Register both if people use Cursor's desktop app and its Cloud Agents.

VS Code

Microsoft's Power Pages guide tells Entra admins to register the loopback address http://127.0.0.1:33418 for VS Code under "Mobile and desktop applications," and to use 127.0.0.1 rather than localhost for desktop apps. A VS Code GitHub issue from November 2025, since closed, reported that the flow can fail when port 33418 is busy, and listed https://vscode.dev/redirect and http://127.0.0.1:33418/ among the URIs VS Code registered through DCR. Register both if you pre-register VS Code.

Microsoft Entra ID

If the token request fails with AADSTS9010010, Claude's troubleshooting page says Entra is rejecting the resource value, not the redirect. Add the MCP server URL as an Application ID URI on the API app registration.

Where to find the logs

• The browser. The provider's error page and URL show the rejected redirect_uri.
• Your authorization server's logs. Look for the client ID and the redirect it sent.
• claude.ai. Failed connections include an ofid_ reference ID in the URL, per Claude's troubleshooting page.
• Claude Code. claude mcp get <name> verifies OAuth is configured for a server.
• Cursor. Output panel, MCP Logs.

If it still fails

• Sign-in works but calls return 401. That is a token problem, not a redirect problem. See MCP 401 Unauthorized.
• Discovery fails first. If your auth server sees no traffic, read OAuth protected resource metadata.
• Review your setup against common MCP OAuth misconfigurations and the spec's authorization rules.
• Compare auth vendors in best MCP auth providers.

Need OAuth built into your own MCP server? See MCP development, and check your server against the MCP server risk checklist.

Frequently asked questions