What
MCP servers are outside programs that give Claude Code extra tools, and some of them require you to sign in with OAuth, a standard way of granting access through a separate sign-in service called an authorization server. For MCP servers that use XAA (cross-app access, set with oauth.xaa in the server's configuration), Claude Code now remembers, or pins, the authorization server used when you signed in.
- If the server's published details later name a different authorization server, sign-in stops with the error "XAA: authorization server changed" instead of following the new one.
- Silent token refresh and discovery, the step where Claude Code looks up where to sign in, reuse the pinned server. Token refresh skips discovery when a pinned server exists.
- Before using a configured metadata address or saved discovery details, Claude Code looks up the pinned server. For an
oauth.xaaserver with no pin, this now fails with an error. - Clearing stored MCP credentials keeps the pin (
keepXaaPin). The pin also survives cleanup of placeholder entries. - Discovery details are no longer saved for XAA servers (
saveDiscoveryStatereturns early whenoauth.xaais set). - If stored credentials cannot be read, the flow stops.
In the same change, the options used to start an MCP server replace a fromOrganization true-or-false value with a readEnvAsStarts callback.
Why
A server can no longer quietly switch the service you sign in through after you have trusted it once. If an XAA server legitimately changes its authorization server, expect the error above. Signing out does not clear the pin, so the members point to removing and re-adding the server as the way through.