[sweetmantech]

Before: when an MCP client such as Claude finishes the Recoup sign-in but its token exchange or authorization is rejected, the server logs nothing. A failed bearer check caused by a storage error on /mcp is also swallowed silently. So when the Claude connector reports "sign in failed", the logs can't show which step failed.

After: each rejected authorization or token request logs OAuth request rejected with { event: "oauth_request_rejected", step: "authorization" | "grant", error: <standard OAuth error code or "other"> }. A storage failure while checking an OAuth bearer on /mcp logs oauth_bearer_verification_unavailable. No codes, tokens, client IDs or account IDs are logged.

How: createRecoupOAuthProvider listens to oidc-provider's authorization.error and grant.error events and reduces each error to an allow-listed code with the new getOAuthErrorCode. Registration denials stay unlogged, as the existing diagnostics test expects. verifyBearerToken logs a fixed event in its existing catch. A new test in providerDiagnostics.test.ts checks that a rejected token exchange logs only the step and code.

Context: locally, Claude's real client metadata document (CIMD) and a Claude-style DCR registration both complete authorize, consent, callback, token, bearer check and refresh against this code, including the full OAuth suite on the real SQL migrations (320 tests). So the Claude connector failure only shows up in production, and this logging is meant to name the failing step after one reconnect.

Tests: pnpm test:mcp-oauth passes, as do vitest run app/mcp lib/mcp/oauth and tsc -p tsconfig.build.json.

---

Generated by Claude Code

---

Summary by cubic

Adds diagnostics logging so OAuth authorization and token rejections, plus bearer-check storage failures, no longer fail silently during MCP sign-in.

A rejected authorization or token request now logs OAuth request rejected with the failing step (authorization or grant) and a standard, nonsecret OAuth error code. A storage failure while verifying an OAuth bearer on /mcp logs oauth_bearer_verification_unavailable. No codes, tokens, client IDs, or account IDs are logged. Registration denials remain unlogged.

^{Written for commit 5cd96d7. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api	Ready	Preview	Nov 13, 2026 6:51am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn