n
nkeating
Subject: MCP server OAuth rejects the Claude app's client_id ("Claude-Cowork" — invalid_client)
Hi Render team,
Reporting a gap in your MCP server's OAuth client allowlist.
What happens
Adding https://mcp.render.com/mcp as a custom connector in the Claude
desktop/web app sends the browser to:
https://api.render.com/v1/oauth/authorize
?response_type=code
&client_id=Claude-Cowork
&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback
&code_challenge_method=S256...
Your authorize endpoint returns, before any consent screen:
{"error":"invalid_client","error_description":"unknown or inactive client"}
Diagnosis
Your docs register specific OAuth client IDs — "claude" for Claude Code,
"codex" for Codex, "cursor" for Cursor — and note OAuth is available for
those three tools. The Claude app is a separate surface from the Claude
Code CLI and sends client_id "Claude-Cowork", which isn't on that
allowlist. There's no dynamic client registration to fall back on, and
the client_id is set by the app, so there's nothing configurable at my end.
Confirmed working for contrast
claude mcp add --transport http --client-id claude -s user render \
https://mcp.render.com/mcp
Registers fine and reports "Needs authentication" as expected. The CLI
path is unaffected — this is specific to the app's client ID.
What I'm asking
  1. Can "Claude-Cowork" be registered (redirect_uri
https://claude.ai/api/mcp/auth_callback) so the Claude app connector
works the way the Claude Code one does?
  1. If not, please confirm API-key auth via the Authorization: Bearer
header is the only supported route for the Claude app, and consider
noting that in the MCP docs — the current page reads as though any
Claude client can use OAuth.
Context: Render + Neon hosting a Node/Postgres app; I'd like agent access
to deploys and logs from the Claude app, not just the CLI.
Thanks,
Nic Keating