Fix MCP OAuth redirect mismatch

Most Claude/Cursor connection failures are redirect_uri mismatch or a wrong client secret. Start in /dashboard/developer, expand the app, and list every registered redirect URI.

Canonical URIs: Claude — https://claude.ai/api/mcp/auth_callback ; Cursor desktop — http://localhost:8787/callback ; Cursor Agents / cloud — https://www.cursor.com/agents/mcp/oauth/callback ; Cursor legacy — cursor://anysphere.cursor-mcp/oauth/callback .

Compare scheme (http vs https), host, path, port, and trailing slash. Copy-paste from the client docs into the console rather than typing by hand. Add every URI your client might use (local + cloud).

Confirm the authorize request uses the same redirect_uri that is registered and that you will send again on the token exchange. The redirect_uri on /api/oauth/token must match the one used at authorize.

PKCE: clients must send code_challenge_method=S256 and later the matching code_verifier. Plain method is rejected. If the verifier is wrong, token exchange fails even when redirect URIs are correct.

state must be present (min 8 characters) and validated by the client on return. Missing or short state can fail the authorize step.

Wrong client secret: regenerate in the console, update the AI client, and retry. Old secrets stop working immediately after regenerate.

Merchant must be signed in during authorize and must own a store. If authorize redirects to login, finish sign-in and retry — callbackUrl should return you to the consent screen.

After a successful connect, Activity should show agent actions and the app should list a Connected grant. If OAuth succeeds but tools fail, check scopes (INSUFFICIENT_SCOPE) and that you are calling https://www.ettajer.com/api/v1/mcp .

Still stuck? Contact support with: client (Claude/Cursor), exact redirect URI registered, error message text, and approximate time. Never send client secrets, API keys, or access tokens.