APIblazeAPIblaze
Add OAuth to your MCP server

How to get your API into Claude and ChatGPT?

Claude’s connector checklist is the list of sign-in rules your MCP server must follow before Claude will connect to it.

APIblaze follows every one. Run the command below and it puts a gateway in front of your API with OAuth already set up. You get an MCP address to paste into Claude, plus authorization: rules for what each signed-in person is allowed to do.

Get an MCP server Claude can connect to

$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml

Paste it in a terminal. No sign-up, no servers. The link is a sample restaurant API; swap in your own API’s address. It prints an MCP address: in Claude, open Customize, then Connectors, then Add custom connector, and paste it.

Claude’s checklist

What Claude requires from your MCP server

These are the rules Claude’s documentation sets for connectors. Your MCP server has to meet every one, or the connection fails. APIblaze takes care of that instantly: point it at your API and you get an MCP server that passes every rule.

Each row gives the rule in plain words, the tech word for it, and what it takes to build yourself versus one command from APIblaze.

Built in Built inYou build it You build it

Answer “sign in first” the way Claude expectsThe tech word for it: a 401 with a WWW-Authenticate resource_metadata pointer

  • You build itBuild it yourself 1–2 hours

    Code in front of every MCP request that refuses unsigned calls with exactly that reply.

  • Built inAPIblaze Included

    Every MCP address answers unsigned calls that way.

Say where people sign inThe tech word for it: protected resource and authorization server metadata (RFC 9728, RFC 8414)

  • You build itBuild it yourself 2–4 hours

    Two discovery documents under /.well-known/, whose address must match your MCP address exactly.

  • Built inAPIblaze Included

    Published for every server.

Let Claude introduce itselfThe tech word for it: Client ID Metadata Document (CIMD) or dynamic client registration (RFC 7591)

  • You build itBuild it yourself 1–3 days

    Fetch and check Claude’s published identity, or run a registration endpoint that gains a new client on every connection.

  • Built inAPIblaze Included

    Both. Claude uses its published identity, which you approve once.

A safe sign-in handshakeThe tech word for it: PKCE with S256

  • You build itBuild it yourself 2–4 hours

    Check a one-time proof on every sign-in, so a stolen code is useless.

  • Built inAPIblaze Included

    Required on every sign-in.

Send people back to Claude, and only to ClaudeThe tech word for it: redirect URI https://claude.ai/api/mcp/auth_callback

  • You build itBuild it yourself 2–4 hours

    Accept Claude’s return address and refuse look-alikes, or someone else collects the tokens.

  • Built inAPIblaze Included

    Checked exactly against the addresses Claude publishes.

Keep people signed inThe tech word for it: refresh tokens, with invalid_grant when one is no longer valid

  • You build itBuild it yourself 1–2 days

    A token endpoint that renews access and answers errors in the exact form Claude expects.

  • Built inAPIblaze Included

    Built in: people stay connected without signing in again.

An actual sign-inThe tech word for it: an identity provider

  • You build itBuild it yourself 2–5 days

    Pick a login provider, connect it, and store your users.

  • Built inAPIblaze Included

    Hosted GitHub sign-in out of the box, or your own: Google, Microsoft, Auth0 or any OpenID Connect provider.

Answer within 10 seconds, from the public internetThe tech word for it: endpoint latency and Anthropic’s egress range

  • You build itBuild it yourself 1–2 days

    Keep sign-in fast, on a public address, with your firewall open to Anthropic’s servers.

  • Built inAPIblaze Included

    Hosted on Cloudflare’s global network, with nothing for you to keep online.

Claude’s whole checklist

  • Build it yourself: about 1–3 weeks of work
  • APIblaze: one command, under 30 seconds

Not on Claude’s list, but what makes it safe

Decide who may do whatThe tech word for it: authorization

  • You build itBuild it yourself 1–2 weeks

    A check in every tool you write.

  • Built inAPIblaze Included

    Rules like “only the person who made a booking can change it”, applied before your code runs.

Times are rough estimates for one experienced developer using common OAuth libraries, including testing the connection with Claude. Starting from scratch, or adding many tools, takes longer.

How it works

What happens when someone adds your connector

Ana wants Claude to manage her bookings at a restaurant. This is what passes between Claude and the restaurant’s server, and where each item on the checklist comes in.

  1. 1

    She adds it

    Ana pastes the restaurant’s MCP address into Claude as a custom connector and clicks Connect.

  2. 2

    Claude is told to sign in

    The server answers: not without signing in, and here is where.

    The tech word for it: a 401 with resource metadata

  3. 3

    Claude introduces itself

    Claude shows the sign-in server its published identity, including the one address Ana may be sent back to.

    The tech word for it: client registration

  4. 4

    Ana signs in

    A sign-in page opens. She signs in with GitHub, sees that Claude is asking, and agrees.

    The tech word for it: OAuth with PKCE

  5. 5

    Claude gets her pass

    Claude receives a token that says “this is Ana”, and renews it before it runs out.

    The tech word for it: access and refresh tokens

  6. 6

    Every request is Ana’s

    “List my bookings” shows hers. Asking to cancel Ben’s is refused before the restaurant’s code ever sees it.

    The tech word for it: authorization

The gap after sign-in

Passing Claude’s checklist still leaves a gap

Once your server passes the checklist, Claude knows who is asking: it’s Ana. But nothing on Claude’s list says what Ana is allowed to do, and an AI assistant tries whatever it is asked. Cancel Ben’s booking? See every customer’s bookings? Call your server a thousand times a minute? Unless something stops it, your server says yes.

APIblaze closes that gap, in the same gateway.

Included

Only what’s theirs

Ana can change her bookings, not Ben’s. Rules are written in plain English and checked on every call.

The tech word for it: authorization

Included

Managers and staff

Put people in groups and decide what each group may do. The manager sees every booking; a customer sees their own.

The tech word for it: roles and groups

Included

Not a thousand times a minute

Every new server starts with a rate limit of 10 requests a second per caller and a quota of 3,000 a day, so an assistant stuck in a loop can’t flood you.

The tech word for it: rate limits and quotas

Your users, your call

Approve Claude once, then everyone just signs in

A sign-in server that lets any app register is a phishing tool: a stranger registers an app that looks like yours and collects your users’ sign-ins. So APIblaze holds every new app until you approve it.

A new server says yes on its own

In its first hour, apps that connect are approved automatically, so your first test just works.

After that, one command

It approves the next app that connects, and only that one.

npx apiblaze@latest allowoauthregistration

Or from your inbox

When a new app is waiting, you get an email with a link to approve it.

One approval covers everyone who connects from claude.ai, the desktop app and the mobile apps.

Troubleshooting

“Couldn’t reach the MCP server”: the usual causes

Despite the wording, it is rarely the network. These are the causes Claude’s own troubleshooting guide lists, in the order it checks them.

  1. 1

    Claude can’t find your sign-in server

    Your 401 has no pointer, and the /.well-known/ addresses return 404, so Claude never learns where to send people.

  2. 2

    Claude has no way to register

    Your sign-in server offers neither a registration endpoint nor support for Claude’s published identity.

  3. 3

    A firewall blocks Anthropic

    A CDN or bot rule answers 403 or 429 to Anthropic’s servers before your code ever sees the request.

  4. 4

    Your address redirects

    Apex to www, or a vanity domain to a CDN. Claude drops the sign-in token when it is redirected to another host, and you get “Authorization with the MCP server failed”.

  5. 5

    Your server is only reachable privately

    claude.ai connects from Anthropic’s servers, so an address that only works on your network or VPN fails, even when it works from your laptop.

  6. 6

    Your token endpoint is slow

    Claude waits 10 seconds for a token. Any slower and sign-in fails, even if the token would have arrived.

With APIblaze, the gateway handles this part. It serves the pointer, the discovery documents and both ways for Claude to register, on a public address that doesn’t redirect.

Common questions

How do I add OAuth to my MCP server so it works with Claude?

Your server has to answer unsigned calls with a 401 that points to its sign-in details, publish those details, let Claude register (with its published identity or by dynamic registration), support PKCE, accept Claude’s return address and renew tokens. Or put APIblaze in front of it, which does all of that with one command.

Can I use an API key instead of OAuth?

Only partly. Claude can send a fixed key in a request header, but that is in beta for a limited set of organizations, and everyone in the organization shares the key, so your server can’t tell people apart. For anything per person, Claude expects OAuth. APIblaze gives you both: keys for apps, sign-in for people.

Should my server support DCR or CIMD?

Claude prefers CIMD, its published identity, when your sign-in server advertises it, and falls back to DCR (dynamic client registration) otherwise. DCR adds a new registration for every fresh connection, which piles up on a popular server. APIblaze supports both and advertises CIMD.

Does it work in the Claude desktop app and on mobile?

Yes. claude.ai, the desktop app and the mobile apps use the same sign-in, so the same checklist covers all three.

Can I keep my existing login?

Yes. Instead of the hosted GitHub sign-in, point APIblaze at your own OAuth app, such as Auth0, Google or Microsoft, or at your own token issuer. Your users sign in where they already do.

Do I need to be listed in Claude’s directory?

No. Anyone can add your server by its address as a custom connector: in their own settings on Free, Pro and Max plans (Free allows one custom connector), and on Team and Enterprise plans an Owner adds it for the organization. The directory is a separate, reviewed listing.

Do my users need an APIblaze account?

No. They sign in with GitHub or with your own login. Only you, the owner of the server, use APIblaze.

Pass Claude’s checklist now

One command, no sign-up. Sign-in, permissions and limits, ready for Claude.

$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml
Using an AI coding assistant? Paste this into Claude Code or Codex:Make my API a Claude connector with sign-in using npx apiblaze@latest skills
Read more:What is an API gateway? Roles and groups Host a remote MCP server Scoped API keys Rate limits and quotas An endpoint per customer OAuth sign-in Authorization rules MCP servers Docs

Sources

Claude’s requirements were checked against its connector documentation in October 2026. They change; if something here is out of date, tell us and we’ll fix it.

Claude is a trademark of Anthropic, PBC. APIblaze is not affiliated with Anthropic.