Fix MCP OAuth CIMD redirect_uris Port Mismatch (invalid_redirect_uri) in Claude Code 2.1.80+ for Granola, Slack, Notion MCP, Meta Ads MCP, and All CIMD-Enabled Providers

Symptoms

• MCP OAuth authentication fails with 'invalid_redirect_uri' or 'redirect_uri did not match any configured URIs' error immediately after opening the browser authorization page
• Error message references portless URI like 'http://localhost/callback' while the actual redirect goes to 'http://localhost:3118/callback'
• All MCP providers advertising 'client_id_metadata_document_supported: true' in their OAuth discovery metadata are affected simultaneously
• Downgrading Claude Code to v2.1.79 immediately resolves authentication without any provider-side changes

Error signatures

invalid_redirect_uri

redirect_uri did not match any configured URIs

The provided redirect_uris are not registered for this client

SDK auth failed: The provided redirect_uris are not registered

Passed URI: http://localhost:3118/callback

Possible causes

• Claude Code v2.1.80 introduced a new clientMetadataUrl getter on the MCP OAuth provider class that always returns 'https://claude.ai/oauth/claude-code-client-metadata' instead of undefined. Before v2.1.80, when clientMetadataUrl was undefined, the OAuth flow always fell through to dynamic client registration which sent the correct redirect_uris including the port (e.g. http://localhost:3118/callback). After v2.1.80, when a provider advertises client_id_metadata_document_supported: true, Claude Code uses the published metadata document which contains only portless redirect_uris (http://localhost/callback and http://127.0.0.1/callback). The provider compares the portless published URI against the actual redirect URI with port 3118, they don't match, and authentication fails.
• The published Claude Code OAuth metadata at https://claude.ai/oauth/claude-code-client-metadata contained 'redirect_uris': ['http://localhost/callback', 'http://127.0.0.1/callback'] without any port specification, which violates IETF OAuth 2.1 draft §8.4.2 requiring support for any port on localhost redirect URIs.
• Even after clearing and re-adding MCP servers in Claude Code, the macOS Keychain caches stale OAuth tokens. A failed OAuth attempt before the server-side metadata fix can leave a cached state that blocks retry — the Keychain must be manually cleared.
• The regression went undetected for weeks because the published metadata document was updated server-side without a corresponding client-side version bump, making it hard to correlate the fix with a specific Claude Code version.

Solutions

npm uninstall -g @anthropic-ai/claude-code

npm install -g @anthropic-ai/claude-code@2.1.79

claude --version

npm install -g @anthropic-ai/claude-code@latest

claude --version

# Clear OAuth token cache (macOS):

security delete-generic-password -s 'Claude Code MCP OAuth' 2>/dev/null

security delete-generic-password -l 'Claude Code MCP' 2>/dev/null

security find-generic-password -s 'Claude Code' 2>/dev/null

security delete-generic-password -s 'Claude Code MCP OAuth' 2>/dev/null

security delete-generic-password -l 'Claude Code MCP' 2>/dev/null

Agent JSON

Canonical machine-readable representation of this issue:

{
  "issue_id": "1723f24e-10fb-45e0-8471-76b59b026f0f",
  "slug": "fix-mcp-oauth-cimd-redirect-uris-port-mismatch-invalid-redirect-uri-in-claude-code-2-1-80-for-granola-slack-notion-mcp-m-1be4gn",
  "verification_status": "unverified",
  "canonical_json": "https://codekb.dev/v1/issues/fix-mcp-oauth-cimd-redirect-uris-port-mismatch-invalid-redirect-uri-in-claude-code-2-1-80-for-granola-slack-notion-mcp-m-1be4gn"
}