Skip to main content

MCP | Claude (Desktop, UI) Re-authentication Failure: Users are unable to authenticate to MCP Identity Gateway

Updated

Overview

Users attempting to re-authenticate to the Aembit MCP Gateway from the Claude client may be unable to connect after disconnecting. This failure presents the error signature Sign-In Error | Upstream rejected request (HTTP 401).

Relates To

  • Deployment Type: MCP Gateway
  • Aembit Component: Client Workload, Aembit MCP Gateway
  • Resources/Tooling: Claude (web and Desktop)

Cause

The Claude client has changed its authentication mechanism from Dynamic Client Registration (DCR) to Client ID Metadata Documents (CIMD). The associated Aembit Client Workload configuration lacks the required CIMD identifier, causing re-authentication requests to be rejected.

Solution

Update the Client Workload associated with the Claude access policy to recognize the new CIMD identifier.

  1. Navigate to Client Workload: Locate the Aembit | Client Workload for Claude associated with your existing access policy.

  2. Add CIMD Identifier: Add a new Client Identifier with the following value:

    https://claude.ai/oauth/mcp-oauth-client-metadata
  3. Save Configuration: Save the updated Client Workload.
Powered by Zendesk