Free resource

MCP OAuth client quirks, side by side.

How Claude, Claude Code, ChatGPT, Cursor and VS Code run sign-in against your MCP server, from each vendor's own docs. Every cell links its source, and gaps are marked unverified.

Last checked Nov 4, 2026. Spec version: MCP 2025-11-25.

What the spec requires.

  1. Protected Resource Metadata

    Servers MUST implement RFC 9728 so clients can find the authorization server. MCP spec

  2. Resource indicators

    Clients MUST send the RFC 8707 resource parameter in both the authorization and token requests, using the server's canonical URI. MCP spec

  3. Exact resource match

    The resource value in the metadata must be identical to the URL the client used. RFC 9728 3.3

  4. Registration

    Clients and authorization servers SHOULD support Client ID Metadata Documents (CIMD) and MAY support Dynamic Client Registration (DCR). MCP spec

Client by client.

Cells marked unverified are missing from the vendor docs we checked.

ClientRegistrationRedirect URIDiscovery and resourceRefresh
Claude
web, Desktop, mobile		Prefers CIMD when the server advertises it with none auth, otherwise DCR. No client_credentials. Sourcehttps://claude.ai/api/mcp/auth_callback SourceNeeds a 401 to start sign-in and ignores WWW-Authenticate on a 200. Uses only the first authorization_servers entry. 10s timeout on discovery, registration and token calls. Source Resource parameter: Unverified.Refreshes on a 401 and up to 5 minutes before expiry, with a 30s timeout. Expects invalid_grant for a bad refresh token and rotation for public clients. Source
Claude CodeIts own CIMD. Sourcehttp://localhost/callback and http://127.0.0.1/callback on any port, so match redirects without the port. Source Claude Code docsResource parameter: Unverified.Unverified
ChatGPTPrefers CIMD; the builder can choose DCR. CIMD token auth is none or private_key_jwt. No client_credentials. SourceSend the RFC 9207 iss parameter to keep the redirect URI stable. Sourcecode_challenge_methods_supported must include S256. Echo the resource parameter through the whole flow. mTLS client certificates and fixed egress IPs are available. SourceTokens expire and rotate normally. Exact refresh timing: Unverified. Source
CursorDCR by default. Static OAuth through an auth block with CLIENT_ID and CLIENT_SECRET in mcp.json. CIMD: Unverified. SourceWith DCR, the desktop app registers both a web and a desktop redirect URL. SourceCloud token refresh reads only the standard .well-known location, so serve your metadata there (Cursor staff, forum). Forum PKCE and resource parameter: Unverified.Users report refresh problems on the forum. Forum thread
VS CodeCIMD since 1.106 (Nov 12, 2025), used over DCR when available. Client document at https://vscode.dev/oauth/client-metadata.json. Falls back to manual client credentials. 1.106 notes API guidehttp://127.0.0.1:33418 and https://vscode.dev/redirect SourceThe resource must exactly match the endpoint, for example the /mcp path. GitHub issue PKCE and resource behavior per a third-party write-up. den.devUnverified

Eight checks before you ship.

  1. Answer unauthenticated calls with a 401

    Claude starts sign-in only on a 401. Source

  2. Serve metadata at the standard path

    Use the RFC 9728 well-known path, including the path-insertion form when your issuer has a path. Cursor cloud refresh reads only this location. MCP spec Cursor forum

  3. Make the resource value identical

    Match the exact URL clients use, path included. RFC 9728 VS Code issue

  4. Advertise S256

    ChatGPT treats a server without S256 in code_challenge_methods_supported as unsupported. Source

  5. Support both CIMD and DCR

    Claude, ChatGPT and VS Code prefer CIMD; Cursor uses DCR by default. Claude ChatGPT VS Code Cursor

  6. Put the right auth server first

    Claude reads only the first authorization_servers entry. Source

  7. Match loopback redirects on any port

    Claude Code and VS Code sign in through a local redirect. Claude Code VS Code

  8. Return invalid_grant and rotate refresh tokens

    Claude expects both, plus a form-urlencoded /token endpoint. Source

Run all eight checks in one pass.

oauthpad runs the full sign-in in every client and names the exact step that differs.

Get early access

Sources.

  1. MCP specification 2025-11-25: Authorization
  2. RFC 9728 section 3.3
  3. Claude: Connector authentication
  4. Claude: Building connectors
  5. Claude Code: MCP
  6. OpenAI Apps SDK: Authentication
  7. Cursor: MCP
  8. Cursor forum: OAuth token refresh for MCP servers
  9. Cursor forum thread 155151
  10. Cursor forum thread 141276
  11. Cursor forum thread 130765
  12. Cursor forum thread 176343 (staff reply)
  13. VS Code: MCP servers
  14. VS Code: MCP extension guide
  15. VS Code 1.106 release notes
  16. microsoft/vscode issue 282472
  17. den.dev: CIMD in VS Code (third party)
Early access

Be first to try oauthpad.

Early access members get the free CLI and paid plans first.

Questions or a server to test [email protected]

Used only for oauthpad updates. To delete it, email [email protected].

You're on the list.

Thanks. Your invite arrives by email.