Authentication for connectors changedconnectors/building/authentication
Nearest release: v2.1.309, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 23 Oct 2026 00:06 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 23 Oct 2026 00:07 UTC.
Upstream edited
Recorded here
Lines+44added
Lines−11removed
From line
34
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits9to this page, all time
### Enter your OAuth client in the developer portal ### Which credentials Claude uses when several are set
The whole hunk
from line 34, old and new numbered
/
from line 34
3434| - | - | - |
3535| `oauth_dcr` | OAuth 2.0 with Dynamic Client Registration ([RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)) | Supported by default |
3636| `oauth_cimd` | OAuth 2.0 with [Client ID Metadata Document](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#client-id-metadata-documents) | Supported by default |
37| `oauth_anthropic_creds` | OAuth 2.0 with [Anthropic-held client credentials](#anthropic-held-client-credentials) | Contact `[email protected]` |
37| `oauth_anthropic_creds` | OAuth 2.0 with [Anthropic-held client credentials](#anthropic-held-client-credentials) | Supported. [Enter the client in the developer portal](#enter-your-oauth-client-in-the-developer-portal) |
3838| `custom_connection` | Custom URL or OAuth client credentials [entered at connection time](#credentials-entered-at-connection-time) | Contact `[email protected]` |
3939| `static_headers` | Fixed credential (API key or bearer token) entered by an organization Owner as a request header when adding the connector | Beta, for a limited set of organizations |
4040| `none` | No authentication (authless server) | Supported by default. To leave some tools open and require sign-in for others, see [Lazy authentication](/docs/connectors/building/lazy-authentication.md) |
from line 58
5858* **Multiple URLs**: you list a fixed set of labeled URLs, such as one per region, and users pick one when they connect
5959* **URL pattern**: you give an anchored regular expression that every customer's URL must match, such as `^https://[a-z0-9-]+\.mcp\.example\.com/mcp$`. Each user enters their own URL when they connect, and Claude accepts it only if it matches. Keep the host part of the pattern lowercase, because Claude lowercases the host of the URL the user enters before checking it
6060
61Listings with **Multiple URLs** or a **URL pattern** take longer to review.
61You can choose any option under **Users connect to different URLs**, such as **Multiple URLs** or a **URL pattern**, in a new submission. A listing that uses one can be published only once it has the **Verified** label, and its review takes longer.
6262
6363You choose the URL option and the authentication type separately, but the URL option limits which authentication types work. The table shows which combinations work. Request headers (`static_headers`) are set up by the organization Owner who adds the connector and aren't covered here.
6464
from line 94
9494
9595### Anthropic-held client credentials
9696
97With `oauth_anthropic_creds`, you create an OAuth client for Claude in your own authorization server and Anthropic holds its credentials, so Claude has a stable, registered client without DCR or CIMD on your end. Users still go through your standard OAuth consent screen when they connect. A pure machine-to-machine `client_credentials` grant, where a token is issued with no user in the loop, isn't supported.
97With `oauth_anthropic_creds`, you create an OAuth client for Claude in your authorization server and enter its client ID and secret in the developer portal. Anthropic uses the credentials only for token exchange on behalf of consenting users. Users still go through your standard OAuth consent screen when they connect. A machine-to-machine `client_credentials` grant, where a token is issued with no user, isn't supported.
9898
99To use this type:
99A listing can use Anthropic-held client credentials whether it's labeled **Community** or **Verified**. The credentials are tied to exact server URLs, so they can't be used with a [URL pattern](#servers-with-per-customer-urls), where each customer enters their own URL.
100100
101* **Create a confidential client**: create a `client_id` and `client_secret` for Claude in your authorization server
102* **Send the credentials to Anthropic**: email `[email protected]` with the `client_id` to set up Anthropic-held credentials. Anthropic replies with how to transfer the client secret securely, so don't put the secret in the email. Anthropic uses the credentials only for token exchange on behalf of consenting users
103* **Plan for Claude Code separately**: the hosted Claude apps, which are claude.ai on the web, Desktop, mobile, and Cowork, share this client. Claude Code doesn't use it: it runs its own OAuth flow on the user's machine, identifies itself with its own [Client ID Metadata Document](#callback-urls), and redirects to a loopback callback URL
104* **Tell Anthropic before you migrate authorization servers**: the credentials are bound to the authorization server that issued them. Email `[email protected]` with the new `client_id` before cutting over, and transfer the new secret the same way as the first
105* **Don't combine it with a URL pattern**: the credentials are tied to exact server URLs, so they can't be used where each customer enters their own server URL. See [Servers with per-customer URLs](#servers-with-per-customer-urls) for the alternatives
101Before you enter the client in the portal:
102
103* **Create a confidential client**: create a client ID and secret for Claude in your authorization server, and register the redirect URI `https://claude.ai/api/mcp/auth_callback`
104* **Plan for Claude Code separately**: claude.ai on the web, Desktop, mobile, and Cowork share this client. Claude Code doesn't use it, and instead uses its own Client ID Metadata Document and a loopback redirect, as [Callback URLs](#callback-urls) describes
105
106### Enter your OAuth client in the developer portal
107
108If your listing uses Anthropic-held client credentials, enter your OAuth client in the **How users authenticate** section when you [submit your connector](/docs/connectors/building/submission.md):
109
1101. Under **Authentication requirement**, select **Always required** or **Required when the server asks**.
1112. Under **Authentication methods**, find the **OAuth sign-in** card. If there's none, click **Add OAuth sign-in**.
1123. Under **OAuth client**, select **Anthropic-held client credentials** and enter your client ID in the **Client ID** field.
1134. Under **Client secret**, select **Anthropic holds a client secret** and enter the secret.
114
115When you submit, the portal stores the secret and doesn't show it again. If you reload the page before you submit, enter the secret again. Once your listing is published, Claude uses the client for new connections, except in the cases that [Which credentials Claude uses when several are set](#which-credentials-claude-uses-when-several-are-set) describes.
116
117To change the client later, open your listing's submission detail page in the [developer portal](https://claude.ai/directory/manage), go to **Connection & authentication**, and click **Edit authentication** or **Author authentication**, whichever the section shows. On a published listing:
118
119* **A new client ID waits for a reviewer**: keep your old client working on your authorization server, because people who connected earlier signed in with it
120* **Switching from another sign-in method needs Anthropic**: email `[email protected]` with your listing's name and its exact server URLs, then save the change once Anthropic confirms. Don't put the secret in the email
121
122### Which credentials Claude uses when several are set
123
124For a directory listing where Anthropic holds your client secret, the client Claude signs users in with can come from three places:
125
126* **The user's organization**: a client that an admin in the user's organization entered for your server's URL, such as when adding your server as a custom connector
127* **You**: the client you entered in the developer portal
128* **Anthropic**: a client that Anthropic set up for your server's URL
129
130For new connections, Claude checks them in that order and uses the first one it finds. If the organization's or Anthropic's client has a different client ID from your listing's, sign-in fails instead of moving on to the next one.
131
132These cases change which client is used, or whether you can save yours:
133
134* **Some connections, such as older ones**: these don't use the client you entered. They use the organization's or Anthropic's client if either exists, and otherwise your server's own [DCR or CIMD](#dcr-and-cimd-details) registration. If there's no such client and your server supports neither, sign-in fails for those connections
135* **A client Anthropic already holds**: if Anthropic holds a client for any of your listing's URLs, you can't save your client secret or request header values on a published listing. You can save them once Anthropic removes its client or checks your listing again. On a listing that isn't published yet, you can save them, but the listing can't go live until Anthropic checks it. In either case, email `[email protected]` with your listing's name and its exact server URLs, and don't put the secret in the email
136* **Custom connectors**: a custom connector that someone adds with your server's URL never uses the client secret you entered in the portal
137
138For each request header on your listing, select the **Anthropic holds one shared value** checkbox in the developer portal to enter one value yourself that every organization uses. Leave it unchecked so each person who adds your connector enters their own value. You can't select the checkbox on a listing with a [URL pattern](#servers-with-per-customer-urls). Header values come only from you or from the people who add your connector, never from Anthropic.
106139
107140### Credentials entered at connection time
108141
No line in this hunk matches that.