OAuth path to /api/mcp always 401d with claim invalid: aud. Authentik only evaluates a scope mapping when the client requests that scope, and clients learn scope names from scopes_supported — which omitted the audience scope.
OAuth path to /api/mcp always 401d with `claim invalid: aud`. Authentik only evaluates a scope mapping when the client requests that scope, and clients learn scope names from `scopes_supported` — which omitted the audience scope.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The OAuth path to /api/mcp has never worked end to end. Every access token
arrived without an `aud` claim and jwt.ts rejected it with
"claim invalid: aud" (401), even though the handshake, consent and PKCE all
succeeded. Only the CLI HMAC path worked, because cli-token.ts sets the
audience itself — which is why this went unnoticed.
Cause: Authentik evaluates a scope mapping only when the client REQUESTS
that scope by name. An MCP client learns which scopes to request from
`scopes_supported` in our RFC 9728 protected-resource metadata, and we only
advertised openid/profile/email. So the `aud-shared-memory` mapping was
attached to the provider but never evaluated.
Advertise the audience scope in that metadata. Name is derived as
`aud-<OIDC_AUDIENCE>` to match the README convention, overridable with the
new optional OIDC_AUDIENCE_SCOPE for deployments that named it differently.
Also documents that Claude Code's RFC 8707 `resource` parameter is ignored
by Authentik 2026.5, so it cannot be relied on for audience binding.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jknapp
merged commit 7d4e8daaaf into main2026-07-27 12:58:57 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
OAuth path to /api/mcp always 401d with
claim invalid: aud. Authentik only evaluates a scope mapping when the client requests that scope, and clients learn scope names fromscopes_supported— which omitted the audience scope.🤖 Generated with Claude Code
aud60cfb19772