Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Documentation 25 Sep 2026
One change · claude-docs

Lazy authentication for MCP servers changedconnectors/building/lazy-authentication

Nearest release: v2.1.283, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 25 Sep 2026 18:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.

Upstream edited
Recorded here
Lines+7added
Lines−7removed
From line 6 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits4to this page, all time

The whole hunk

from line 6, old and new numbered
/
lines
from line 6
66 
77When Claude reaches a protected tool, it shows the sign-in prompt inline in the conversation, and after the person signs in it retries the same tool call. The challenge your server sends to trigger that prompt follows the [MCP authorization specification](https://modelcontextprotocol.io/specification/latest/basic/authorization).
88 
9This page is for developers whose MCP server has some tools that work without the user's identity. It walks through excerpts from an example Express server, a single `src/index.ts` file built on `@modelcontextprotocol/sdk` over Streamable HTTP, to show what your own server needs at each step. For the OAuth requirements every server must meet regardless of when it asks for sign-in, see [Authentication for connectors](/docs/connectors/building/authentication).
9This page is for developers whose MCP server has some tools that work without the user's identity. It walks through excerpts from an example Express server, a single `src/index.ts` file built on `@modelcontextprotocol/sdk` over Streamable HTTP, to show what your own server needs at each step. For the OAuth requirements every server must meet regardless of when it asks for sign-in, see [Authentication for connectors](/docs/connectors/building/authentication.md).
1010 
1111## See what the user experiences
1212 
from line 19
1919 
2020> [!NOTE]
2121>
22> If the user's organization has [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth) configured for your connector, the same refusal triggers a silent token exchange instead of the **Connect** card. Claude retries the tool call automatically and the user sees no prompt.
22> If the user's organization has [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth.md) configured for your connector, the same refusal triggers a silent token exchange instead of the **Connect** card. Claude retries the tool call automatically and the user sees no prompt.
2323 
2424## Build lazy authentication on your server
2525 
from line 304
3043042. In Claude, go to [**Customize > Connectors**](https://claude.ai/customize/connectors) and select **Add custom connector**.
3053053. Enter the tunnel's `/mcp` URL.
306306 
307See [Test a local server](/docs/connectors/building/testing#test-a-local-server) for details. If your app comes from the SDK's `createMcpExpressApp()`, that section also shows the `allowedHosts` option you need before requests through the tunnel succeed.
307See [Test a local server](/docs/connectors/building/testing.md#test-a-local-server) for details. If your app comes from the SDK's `createMcpExpressApp()`, that section also shows the `allowedHosts` option you need before requests through the tunnel succeed.
308308 
309309**5. Try both paths in a conversation**
310310 
from line 313
313313 
314314## Next steps
315315 
316* [Authentication for connectors](/docs/connectors/building/authentication): check the OAuth requirements your authorization server must meet, including redirect URIs and token refresh
317* [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth): let organizations with SSO answer the same `401` with a silent token exchange
318* [Test your connector](/docs/connectors/building/testing): expose the server through a tunnel and add it as a custom connector
319* [Troubleshoot your connector](/docs/connectors/building/troubleshooting): diagnose discovery and authorization failures
316* [Authentication for connectors](/docs/connectors/building/authentication.md): check the OAuth requirements your authorization server must meet, including redirect URIs and token refresh
317* [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth.md): let organizations with SSO answer the same `401` with a silent token exchange
318* [Test your connector](/docs/connectors/building/testing.md): expose the server through a tunnel and add it as a custom connector
319* [Troubleshoot your connector](/docs/connectors/building/troubleshooting.md): diagnose discovery and authorization failures
320320 
Feedback