Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Documentation 25 Sep 2026
One change · claude-docs

Authenticate to MCP servers behind a tunnel changedconnectors/mcp-tunnels/oauth

Nearest release: v2.1.283, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 25 Sep 2026 18:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 22:07 UTC.

Upstream edited
Recorded here
Lines+6added
Lines−6removed
From line 39 where the diff opens
First seen 31 Aug 2026 this site's first read of the page
Recorded edits6to this page, all time

The whole hunk

from line 39, old and new numbered
/
lines
from line 39
3939 
4040When you add the tunneled MCP server as a custom connector in [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors), turn on **Tunnel OAuth configuration** in the connector dialog. The values you enter replace the ones Claude would otherwise read from the authorization server's metadata. Anthropic enables this option for each organization in the research preview on request, so if the toggle does not appear in the dialog, contact your Anthropic account team.
4141 
42| Field | What to enter | Example |
43| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
44| **Issuer** | The issuer identifier your authorization server puts in its metadata and tokens. This can be an internal URL, because Claude uses it for validation rather than as an address to connect to. | `https://sso.example.corp:8443` |
45| **Authorization endpoint** | The sign-in URL that members' browsers are redirected to. It must be loadable from their devices, on the public internet or your corporate network. | `https://sso.example.corp/authorize` |
46| **Token endpoint** | The token endpoint Claude exchanges the authorization code at. Either the endpoint as reached through the tunnel (an `https://` URL under your tunnel domain), or a public `https://` URL on the same origin (scheme, host, and port) as the **Authorization endpoint**. | `https://auth.abc123.tunnel.anthropic.com/oauth/token` |
42| Field | What to enter | Example |
43| - | - | - |
44| **Issuer** | The issuer identifier your authorization server puts in its metadata and tokens. This can be an internal URL, because Claude uses it for validation rather than as an address to connect to. | `https://sso.example.corp:8443` |
45| **Authorization endpoint** | The sign-in URL that members' browsers are redirected to. It must be loadable from their devices, on the public internet or your corporate network. | `https://sso.example.corp/authorize` |
46| **Token endpoint** | The token endpoint Claude exchanges the authorization code at. Either the endpoint as reached through the tunnel (an `https://` URL under your tunnel domain), or a public `https://` URL on the same origin (scheme, host, and port) as the **Authorization endpoint**. | `https://auth.abc123.tunnel.anthropic.com/oauth/token` |
4747| **Registration endpoint (optional)** | The dynamic client registration endpoint, under the same rule as **Token endpoint**: a URL under your tunnel domain or one on the **Authorization endpoint**'s origin. Leave it blank if you select **Use your own OAuth client** and enter a client ID you registered with the authorization server yourself. | `https://auth.abc123.tunnel.anthropic.com/oauth/register` |
48| **Requested scopes** | The scopes Claude requests at sign-in, separated by spaces. | `openid wiki:read wiki:write` |
48| **Requested scopes** | The scopes Claude requests at sign-in, separated by spaces. | `openid wiki:read wiki:write` |
4949 
5050The paths after the hostname (`/authorize`, `/oauth/token`, and so on) are whatever your authorization server uses. Copy them from its metadata document, usually served at `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration`, and change only the scheme and host.
5151 
Feedback