fix: plain 401 for MCP OAuth discovery (#74)

* fix: return plain 401 for MCP OAuth discovery and harden auth flow

- Return plain HTTP 401 with WWW-Authenticate header (no JSON-RPC body)
  so Claude Desktop's MCP client can trigger OAuth discovery correctly
- Remove unused apiKey import from authorize route
- Remove stale codeChallengeMethod parameter from oauth-codes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add Retry-After header to 429 rate limit response

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

This commit is contained in:

Jakob Wennberg

2026-03-21 14:47:47 +01:00

committed by

GitHub

co-authored by

Claude Opus 4.6

parent 5d66dd6bfc

commit d61670231f

3 changed files with 14 additions and 13 deletions

									
										lib/auth/oauth-codes.ts
									
		-1
	
												View File
												
				@@ -21,7 +21,6 @@ function getEncryptionKey(): Buffer {

				export interface AuthCodePayload {

				  userId: string

				  codeChallenge: string

				  codeChallengeMethod: string

				  redirectUri: string

				  exp: number

				}