Authenticate to MCP servers behind a tunnel changedconnectors/mcp-tunnels/oauth
Nearest release: v2.1.283, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 25 Sep 2026 18:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+5added
Lines−5removed
From line
10
where the diff opens
First seen
31 Aug 2026
this site's first read of the page
Recorded edits6to this page, all time
The whole hunk
from line 10, old and new numbered
/
from line 10
1010
1111> [!NOTE]
1212>
13> If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector.
13> If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup.md#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector.
1414
1515## Understand how OAuth works through a tunnel
1616
from line 25
2525
2626## Route the authorization server through the tunnel
2727
28Add a route for the authorization server to the proxy configuration, next to the routes for your MCP servers, and apply it as described in [Add more servers later](/docs/connectors/mcp-tunnels/setup#add-more-servers-later).
28Add a route for the authorization server to the proxy configuration, next to the routes for your MCP servers, and apply it as described in [Add more servers later](/docs/connectors/mcp-tunnels/setup.md#add-more-servers-later).
2929
3030```yaml theme={null}
3131routes:
from line 49
4949
5050The paths after the hostname (`/authorize`, `/oauth/token`, and so on) are whatever your authorization server uses. Copy them from its metadata document, usually served at `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration`, and change only the scheme and host.
5151
52After you save the connector, connect it yourself from your own connector settings. Your browser should open your sign-in page, and after you approve access the connector should show as connected. If either step fails, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#sign-in-redirects-to-a-tunnel-address-that-does-not-load).
52After you save the connector, connect it yourself from your own connector settings. Your browser should open your sign-in page, and after you approve access the connector should show as connected. If either step fails, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#sign-in-redirects-to-a-tunnel-address-that-does-not-load).
5353
5454## Publish split metadata instead
5555
from line 80
8080
8181## Next steps
8282
83* [Add tunneled servers as connectors](/docs/connectors/mcp-tunnels/setup#add-tunneled-servers-as-connectors): where you add the connector and turn on **Tunnel OAuth configuration**
84* [Troubleshoot OAuth sign-in](/docs/connectors/mcp-tunnels/troubleshooting#oauth-sign-in): fix sign-in redirects that don't load and token exchanges that fail
83* [Add tunneled servers as connectors](/docs/connectors/mcp-tunnels/setup.md#add-tunneled-servers-as-connectors): where you add the connector and turn on **Tunnel OAuth configuration**
84* [Troubleshoot OAuth sign-in](/docs/connectors/mcp-tunnels/troubleshooting.md#oauth-sign-in): fix sign-in redirects that don't load and token exchanges that fail
8585
No line in this hunk matches that.