One read of Claude Documentationclaude-docs-20261023T000706Z
4 pages moved out of 280 read.
Pages moved
4
significant first
Pages read
280
in this capture
Captured
00:07 UTC
Corpus hash
cb14c9048643
corpus-hash
What this read moved
1-4 of 4connectors/building/authentication Changed · +44 / -11 lines
### Enter your OAuth client in the developer portal ### Which credentials Claude uses when several are set
from line 34
3434| - | - | - |
3535| `oauth_dcr` | OAuth 2.0 with Dynamic Client Registration ([RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)) | Supported by default |
3636| `oauth_cimd` | OAuth 2.0 with [Client ID Metadata Document](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#client-id-metadata-documents) | Supported by default |
37| `oauth_anthropic_creds` | OAuth 2.0 with [Anthropic-held client credentials](#anthropic-held-client-credentials) | Contact `[email protected]` |
37| `oauth_anthropic_creds` | OAuth 2.0 with [Anthropic-held client credentials](#anthropic-held-client-credentials) | Supported. [Enter the client in the developer portal](#enter-your-oauth-client-in-the-developer-portal) |
3838| `custom_connection` | Custom URL or OAuth client credentials [entered at connection time](#credentials-entered-at-connection-time) | Contact `[email protected]` |
3939| `static_headers` | Fixed credential (API key or bearer token) entered by an organization Owner as a request header when adding the connector | Beta, for a limited set of organizations |
4040| `none` | No authentication (authless server) | Supported by default. To leave some tools open and require sign-in for others, see [Lazy authentication](/docs/connectors/building/lazy-authentication.md) |
from line 58
5858* **Multiple URLs**: you list a fixed set of labeled URLs, such as one per region, and users pick one when they connect
5959* **URL pattern**: you give an anchored regular expression that every customer's URL must match, such as `^https://[a-z0-9-]+\.mcp\.example\.com/mcp$`. Each user enters their own URL when they connect, and Claude accepts it only if it matches. Keep the host part of the pattern lowercase, because Claude lowercases the host of the URL the user enters before checking it
6060
61Listings with **Multiple URLs** or a **URL pattern** take longer to review.
61You can choose any option under **Users connect to different URLs**, such as **Multiple URLs** or a **URL pattern**, in a new submission. A listing that uses one can be published only once it has the **Verified** label, and its review takes longer.
6262
6363You choose the URL option and the authentication type separately, but the URL option limits which authentication types work. The table shows which combinations work. Request headers (`static_headers`) are set up by the organization Owner who adds the connector and aren't covered here.
6464
from line 94
9494
9595### Anthropic-held client credentials
9696
97With `oauth_anthropic_creds`, you create an OAuth client for Claude in your own authorization server and Anthropic holds its credentials, so Claude has a stable, registered client without DCR or CIMD on your end. Users still go through your standard OAuth consent screen when they connect. A pure machine-to-machine `client_credentials` grant, where a token is issued with no user in the loop, isn't supported.
97With `oauth_anthropic_creds`, you create an OAuth client for Claude in your authorization server and enter its client ID and secret in the developer portal. Anthropic uses the credentials only for token exchange on behalf of consenting users. Users still go through your standard OAuth consent screen when they connect. A machine-to-machine `client_credentials` grant, where a token is issued with no user, isn't supported.
9898
99To use this type:
99A listing can use Anthropic-held client credentials whether it's labeled **Community** or **Verified**. The credentials are tied to exact server URLs, so they can't be used with a [URL pattern](#servers-with-per-customer-urls), where each customer enters their own URL.
100100
101* **Create a confidential client**: create a `client_id` and `client_secret` for Claude in your authorization server
102* **Send the credentials to Anthropic**: email `[email protected]` with the `client_id` to set up Anthropic-held credentials. Anthropic replies with how to transfer the client secret securely, so don't put the secret in the email. Anthropic uses the credentials only for token exchange on behalf of consenting users
103* **Plan for Claude Code separately**: the hosted Claude apps, which are claude.ai on the web, Desktop, mobile, and Cowork, share this client. Claude Code doesn't use it: it runs its own OAuth flow on the user's machine, identifies itself with its own [Client ID Metadata Document](#callback-urls), and redirects to a loopback callback URL
104* **Tell Anthropic before you migrate authorization servers**: the credentials are bound to the authorization server that issued them. Email `[email protected]` with the new `client_id` before cutting over, and transfer the new secret the same way as the first
105* **Don't combine it with a URL pattern**: the credentials are tied to exact server URLs, so they can't be used where each customer enters their own server URL. See [Servers with per-customer URLs](#servers-with-per-customer-urls) for the alternatives
101Before you enter the client in the portal:
102
103* **Create a confidential client**: create a client ID and secret for Claude in your authorization server, and register the redirect URI `https://claude.ai/api/mcp/auth_callback`
104* **Plan for Claude Code separately**: claude.ai on the web, Desktop, mobile, and Cowork share this client. Claude Code doesn't use it, and instead uses its own Client ID Metadata Document and a loopback redirect, as [Callback URLs](#callback-urls) describes
105
106### Enter your OAuth client in the developer portal
107
108If your listing uses Anthropic-held client credentials, enter your OAuth client in the **How users authenticate** section when you [submit your connector](/docs/connectors/building/submission.md):
109
1101. Under **Authentication requirement**, select **Always required** or **Required when the server asks**.
1112. Under **Authentication methods**, find the **OAuth sign-in** card. If there's none, click **Add OAuth sign-in**.
1123. Under **OAuth client**, select **Anthropic-held client credentials** and enter your client ID in the **Client ID** field.
1134. Under **Client secret**, select **Anthropic holds a client secret** and enter the secret.
114
115When you submit, the portal stores the secret and doesn't show it again. If you reload the page before you submit, enter the secret again. Once your listing is published, Claude uses the client for new connections, except in the cases that [Which credentials Claude uses when several are set](#which-credentials-claude-uses-when-several-are-set) describes.
116
117To change the client later, open your listing's submission detail page in the [developer portal](https://claude.ai/directory/manage), go to **Connection & authentication**, and click **Edit authentication** or **Author authentication**, whichever the section shows. On a published listing:
118
119* **A new client ID waits for a reviewer**: keep your old client working on your authorization server, because people who connected earlier signed in with it
120* **Switching from another sign-in method needs Anthropic**: email `[email protected]` with your listing's name and its exact server URLs, then save the change once Anthropic confirms. Don't put the secret in the email
121
122### Which credentials Claude uses when several are set
123
124For a directory listing where Anthropic holds your client secret, the client Claude signs users in with can come from three places:
125
126* **The user's organization**: a client that an admin in the user's organization entered for your server's URL, such as when adding your server as a custom connector
127* **You**: the client you entered in the developer portal
128* **Anthropic**: a client that Anthropic set up for your server's URL
129
130For new connections, Claude checks them in that order and uses the first one it finds. If the organization's or Anthropic's client has a different client ID from your listing's, sign-in fails instead of moving on to the next one.
131
132These cases change which client is used, or whether you can save yours:
133
134* **Some connections, such as older ones**: these don't use the client you entered. They use the organization's or Anthropic's client if either exists, and otherwise your server's own [DCR or CIMD](#dcr-and-cimd-details) registration. If there's no such client and your server supports neither, sign-in fails for those connections
135* **A client Anthropic already holds**: if Anthropic holds a client for any of your listing's URLs, you can't save your client secret or request header values on a published listing. You can save them once Anthropic removes its client or checks your listing again. On a listing that isn't published yet, you can save them, but the listing can't go live until Anthropic checks it. In either case, email `[email protected]` with your listing's name and its exact server URLs, and don't put the secret in the email
136* **Custom connectors**: a custom connector that someone adds with your server's URL never uses the client secret you entered in the portal
137
138For each request header on your listing, select the **Anthropic holds one shared value** checkbox in the developer portal to enter one value yourself that every organization uses. Leave it unchecked so each person who adds your connector enters their own value. You can't select the checkbox on a listing with a [URL pattern](#servers-with-per-customer-urls). Header values come only from you or from the people who add your connector, never from Anthropic.
106139
107140### Credentials entered at connection time
108141
connectors/building/submission Changed · +3 / -3 lines
from line 131
131131
132132**1. Connection**
133133
134Connect the server you're submitting, by pasting its `https://` URL or choosing a custom connector you've already added to Claude. If your users connect to different URLs, select **Users connect to different URLs** and choose **Multiple URLs** or **URL pattern**.
134Connect the server you're submitting, by pasting its `https://` URL or choosing a custom connector you've already added to Claude. If your users connect to different URLs, select **Users connect to different URLs** and choose **Multiple URLs** or **URL pattern**. A listing that uses one of these options can be published only once it has the **Verified** label, as [Servers with per-customer URLs](/docs/connectors/building/authentication.md#servers-with-per-customer-urls) explains.
135135
136136**2. Tools**
137137
from line 151
151151
152152**6. Authentication**
153153
154How users authenticate: OAuth with dynamic client registration, client ID metadata documents, or Anthropic-held client credentials; a custom connection where users supply their own URL or credentials at connection time; or no authentication. [Authentication](/docs/connectors/building/authentication.md) covers which modes are supported directly and which need coordination with the review team. If your server starts without authentication and individual tools prompt for it on demand, you can flag that here.
154In the **How users authenticate** section, choose whether users must sign in under **Authentication requirement**, and how they sign in under **Authentication methods**. Choose **Required when the server asks** if your server starts without sign-in and only some tools need it. To have Anthropic hold your OAuth client, enter its client ID and secret here, as [Enter your OAuth client in the developer portal](/docs/connectors/building/authentication.md#enter-your-oauth-client-in-the-developer-portal) describes. [Authentication for connectors](/docs/connectors/building/authentication.md) covers each option.
155155
156156If you chose **URL pattern** in the Connection step, Anthropic-held client credentials can't be used. If you chose **Multiple URLs**, a custom connection can't be used.
157157
from line 173
173173
174174## After you submit
175175
176Anthropic scans your submission automatically for policy compliance and, by default, lists it as a Community connector with no action from you. Some submissions also get a review from a person, and those review times vary with queue volume. The portal is always open for new submissions. Your submission's status and any reviewer feedback appear in the portal at [claude.ai/directory/manage](https://claude.ai/directory/manage), and [Track your directory submission](/docs/directory/submission-status.md#mcp-connector-statuses) explains what each status in the portal means. [Manage your directory listing](/docs/connectors/building/managing-your-listing.md) covers reviewer feedback, listing edits, and the server health and usage metrics you get after publication.
176Anthropic scans your submission automatically for policy compliance and, by default, lists it as a Community connector with no action from you. A listing that uses an option under **Users connect to different URLs** can be published only once it has the **Verified** label. Some submissions also get a review from a person, and those review times vary with queue volume. The portal is always open for new submissions. Your submission's status and any reviewer feedback appear in the portal at [claude.ai/directory/manage](https://claude.ai/directory/manage), and [Track your directory submission](/docs/directory/submission-status.md#mcp-connector-statuses) explains what each status in the portal means. [Manage your directory listing](/docs/connectors/building/managing-your-listing.md) covers reviewer feedback, listing edits, and the server health and usage metrics you get after publication.
177177
179179
connectors/building/directory-vs-custom Changed · +1 / -1 lines
from line 94
9494
9595### Per-tenant URLs
9696
97If your server URL varies per tenant, such as `{tenant}.mcp.example.com`, submit one directory listing with a URL pattern. Each user enters their own URL when they connect. See [Servers with per-customer URLs](/docs/connectors/building/authentication.md#servers-with-per-customer-urls) for how this choice limits your authentication options.
97If your server URL varies per tenant, such as `{tenant}.mcp.example.com`, submit one directory listing with a URL pattern. Each user enters their own URL when they connect. A listing with a URL pattern can be published only once it has the **Verified** label. See [Servers with per-customer URLs](/docs/connectors/building/authentication.md#servers-with-per-customer-urls) for how this choice limits your authentication options.
9898
9999## Next steps
100100
connectors/building/managing-your-listing Changed · +2 / -0 lines
from line 83
8383
8484The URL slug is locked. It's permanent after publication because it determines your listing URL.
8585
86To change how users sign in, including the OAuth client ID and secret that Anthropic holds, go to **Connection & authentication** on the listing's submission detail page and click **Edit authentication** or **Author authentication**, whichever the section shows. [Enter your OAuth client in the developer portal](/docs/connectors/building/authentication.md#enter-your-oauth-client-in-the-developer-portal) covers the client fields.
87
8789
8890## Next steps