OAuth: metadata advertises RFC 9207 `iss` support, but /authorize never sends `iss` → strict MCP clients (Claude Code) reject login

[OfficialLexthor]

Summary

https://mcp.tripletex.no/.well-known/oauth-authorization-server advertises

"authorization_response_iss_parameter_supported": true

but the redirect back from https://mcp.tripletex.no/authorize does not include the iss parameter (only code and state).

Per RFC 9207 §2.4, a client that sees this flag MUST validate iss in the authorization response. MCP clients built on the current MCP TypeScript SDK (spec 2026-07-28 / SEP-2468) therefore reject the login:

Issuer mismatch in authorization response (RFC 9207): expected "https://mcp.tripletex.no/", received undefined

Reproduce

1. Add https://mcp.tripletex.no as an HTTP MCP server in Claude Code (v2.1.234).
2. Run /mcp → tripletex → Authenticate, complete login in the browser.
3. Browser shows "Authentication successful", but Claude Code shows the error above and the server stays in "needs authentication".

Same server works via the claude.ai / Claude Desktop connector, because that OAuth client does not enforce the iss check yet.

Environment

• Claude Code 2.1.234 (macOS)
• Metadata checked 2026-08-18

[israrkhan]

Quick emphasize on Same server works via the claude.ai / Claude Desktop connector, because that OAuth client does not enforce the iss check yet..

The above functions as a temporary workaround : Install MCP via Connectors in Claude Desktop, authenticate and utilize the MCP in Claude Code CLI after auth in Claude Desktop.

[magnusrodseth]

Still reproduces on Claude Code 2.1.245 (macOS), metadata rechecked 2026-08-25.

$ curl -s https://mcp.tripletex.no/.well-known/oauth-authorization-server \
  | jq .authorization_response_iss_parameter_supported
true

The redirect back after the company selection step is:

HTTP/2 302
location: http://localhost:<port>/callback?state=<state>&code=<code>

No iss, so the client rejects the login and the server stays in "needs authentication" while the browser shows "Authentication successful".

Fix options

Either send iss=https://mcp.tripletex.no/ in the authorization response, or set authorization_response_iss_parameter_supported to false until you do. The first is the better one: the flag being true is exactly what makes the client-side check mandatory.

Workaround that stays inside Claude Code

For anyone who would rather not route the login through Claude Desktop, the flow can be completed by hand. The key constraint is that the browser must never navigate to the localhost callback. Claude Code's own callback listener receives it, fails the iss check, and cancels the flow, so the authorization code is spent before you can reuse it.

1. Run mcp__tripletex__authenticate to get a fresh authorize URL. Note its redirect_uri port, it changes per attempt.
2. Open that URL in a browser. It lands on /oauth/select-company?id=<selectionId>. Do not click Connect.
3. Read the cookies for that page. tlx_cs_nonce is scoped to Path=/oauth, so read cookies against the full page URL, not the origin. Miss it and the POST below answers 400.
4. Submit the company selection outside the browser, so nothing follows the redirect:

curl -sS -i -X POST https://mcp.tripletex.no/oauth/select-company \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Origin: https://mcp.tripletex.no' \
  -H 'Referer: https://mcp.tripletex.no/oauth/select-company?id=<selectionId>' \
  -b '<cookies from step 3>' \
  --data-urlencode 'selectionId=<selectionId>' \
  --data-urlencode 'companyId=<companyId>'

curl does not follow redirects, so the location: header hands you the callback URL with the code.

5. Call mcp__tripletex__complete_authentication with that URL plus &iss=https%3A%2F%2Fmcp.tripletex.no%2F appended by hand.

That satisfies the RFC 9207 check and the server connects with the full tool set. Each failed attempt invalidates both the authorization code and the selection nonce, so restart from step 1 after any error.