Claude

Expose the API and MCP services over HTTPS, then add the exact MCP_RESOURCE URL to Claude as a custom remote MCP server. The first unauthorized request advertises protected-resource metadata; the client discovers the authorization server and starts Authorization Code with S256 PKCE.

The starter advertises CIMD and supports public dynamic client registration at /oauth/register. Claude Code's metadata URL on claude.ai is allowlisted by default, and its portless loopback callback is matched to the ephemeral local callback port as required for native clients. It intentionally supports token_endpoint_auth_method=none; client secrets do not improve security for software that cannot keep one.

After the user approves a project and project:read, Claude exchanges the code for an audience-bound access token and optional rotating refresh token.

Client product UIs and availability change over time, so use the vendor's current instructions for where to add a custom connector. The server-side protocol configuration remains the same.

In Claude web, open Settings → Connectors, add a custom connector with the public /mcp URL, and connect it. Leave custom client credentials empty to use https://claude.ai/oauth/mcp-oauth-client-metadata. Sign in to the application and approve a project. In a chat, enable the connector, ask it to call get_random_number, and approve the read-only tool when prompted.

Claude's metadata advertises additional capabilities, including JWT bearer grants. The server accepts a client that supports Authorization Code and the code response type; additional advertised capabilities do not enable additional token grants. This avoids rejecting a compatible client while keeping code plus PKCE as the supported login flow.

The web OAuth flow and actual tool call were verified on the Jio deployment. See Claude's custom connector guide for current UI availability.