Claude Code MCP authentication fails: OAuth 404 and API key 'unauthorized'

[minac]

Environment

• Client: Claude Code CLI (latest)
• OS: macOS Darwin 25.1.0
• MCP URL: https://mcp.render.com/mcp

Problem

When configuring the Render MCP server in Claude Code, authentication fails in two different scenarios:

Scenario 1: With API Key Header

Config:

{
  "render": {
    "type": "http",
    "url": "https://mcp.render.com/mcp",
    "headers": {
      "Authorization": "Bearer <VALID_API_KEY>"
    }
  }
}

• Claude Code shows: Auth: ✗ not authenticated
• MCP tools like list_services return unauthorized
• However, select_workspace and get_selected_workspace work correctly
• The same API key works perfectly with the REST API (api.render.com/v1/services)

Scenario 2: Without API Key (OAuth flow)

When removing the Authorization header and clicking "Authenticate" in Claude Code:

Error: HTTP 404: Invalid OAuth error response: SyntaxError: JSON Parse error: Unable to parse JSON string. Raw body: 404 page not found

The OAuth endpoint appears to return a 404.

Expected Behavior

Either:

1. API key authentication should work as documented
2. OAuth flow should open browser and complete authentication

Steps to Reproduce

1. Add Render MCP server to Claude Code: claude mcp add --transport http render https://mcp.render.com/mcp --header "Authorization: Bearer <API_KEY>"
2. Run /mcp in Claude Code
3. Observe "Auth: ✗ not authenticated"
4. Try using any tool like list_services → returns "unauthorized"
5. Alternatively, remove the header and click "Authenticate" → 404 error

Workaround

Using the REST API directly works fine with the same API key.

[yannbc]

Also experiencing this issue when using the MCP server from Tasklet.ai. API key auth returns 'unauthorized' for most tools (list_services, list_workspaces, etc.), though select_workspace and get_selected_workspace do work. The same API key works perfectly with the REST API at api.render.com.

[Aluma]

Reproducing select_workspace Success but No Persistent Workspace State

We are experiencing the same core issue described here, but in an Emergent MCP environment rather than Claude Code.

Environment
• MCP client: mcp-remote
• Transport: --transport sse-only
• Config:

{
  "mcpServers": {
    "render": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote@latest",
        "https://mcp.render.com/mcp",
        "--transport",
        "sse-only",
        "--header",
        "Authorization: Bearer ${RENDER_API_KEY}"
      ],
      "env": {
        "RENDER_API_KEY": "REDACTED"
      }
    }
  }
}

•	Only one workspace exists under this account.
•	API key is valid (confirmed via direct REST API calls).

⸻

Observed Behavior
1. select_workspace({ ownerID: "tea-d67d93d6ubrc738vh0fg" })
→ "Workspace selected"
2. get_selected_workspace()
→ error: "no workspace set. Prompt the user to select a workspace..."
3. list_services()
→ error: "no workspace set..."

This behavior is 100% reproducible across:
• Multiple attempts
• HTTP transport
• SSE-only transport
• Freshly generated API keys

⸻

Important Detail

The same RENDER_API_KEY works correctly when calling the Render REST API directly:

GET /v1/services
Authorization: Bearer

So:
• API key is valid
• Workspace exists
• Permissions are correct

The issue appears to be:

select_workspace acknowledges success, but workspace state is not retained between MCP calls.

This suggests session state is not being persisted correctly server-side.

⸻

Questions
1. Is select_workspace intended to rely on session state?
2. Should workspace context be passed per-call instead?
3. Is this a known issue with mcp-remote transport compatibility?
4. Is there a recommended pattern for stateless MCP clients?

⸻

Happy to provide additional logs if needed.

[moshehbenavraham]

If you're still seeing 404s or 'unauthorized' errors with Claude Code OAuth, this might be the reason. Anthropic recently updated their terms to officially ban subscription-based OAuth tokens for third-party harnesses. A longtime Claude Max subscriber just documented the full context behind this change, including the Clawdbot/OpenClaw C&D that preceded it. Full breakdown here: https://aiwithapexcom.substack.com/p/after-nearly-a-year-on-claude-max

[freditation]

Adding another confirmation — I'm hitting the same issue using the Claude.ai-hosted Render MCP integration (not self-hosted).

What works:

• select_workspace ✅
• get_selected_workspace ✅

What fails with "unknown error":

• list_workspaces
• list_services
• list_postgres_instances
• list_key_value

Basically every tool that hits the Render REST API fails, while the stateful MCP-only operations work fine.

This is a regression — everything was working for me on March 10, 2026 (including select_workspace + query_render_postgres). By April 1 it was broken.