How MCP OAuth works: connecting Claude.ai to external tools

When you click 'Add' in Claude.ai's Connectors settings, it kicks off an OAuth 2.0 authorization code flow with PKCE. This sounds technical, but it's the same secure flow used by 'Sign in with Google' and every modern API integration. Here's what happens under the hood.

Step 1: OAuth discovery

Claude.ai first hits GET /.well-known/oauth-authorization-server on the MCP server. This returns a JSON document listing the authorization endpoint, token endpoint, and registration endpoint. For ReminderIt this is at mcp.reminderit.com.

Step 2: dynamic client registration

Claude.ai sends a POST to the registration endpoint with its redirect URIs. The server validates the URIs against a trusted domain list and returns a client_id. This step means Claude.ai doesn't need to be manually pre-registered as a client — it registers itself automatically.

Step 3: authorization code flow with PKCE

Claude.ai generates a code_verifier (a random string) and derives code_challenge = BASE64URL(SHA256(code_verifier)). It redirects your browser to the authorization endpoint with client_id, redirect_uri, code_challenge, and state. You see the consent page, click Allow, and the server creates a short-lived auth code in Redis.

Claude.ai then sends the code_verifier to the token endpoint along with the code. The server verifies SHA256(code_verifier) matches the stored code_challenge — this ensures that even if someone intercepts the code, they can't use it without the verifier.

Step 4: access token as API key

The token endpoint returns a fresh ReminderIt API key as the access_token. Claude.ai stores it and sends it as Authorization: Bearer rmt_... on every subsequent MCP request. The key is labelled 'Claude (web connector)' in your account and appears in the API Keys section.