Claude custom connector won't connect, or keeps asking you to sign in: the fixes

Where the connector connects from

Claude connects to a custom connector's remote MCP server from Anthropic's cloud infrastructure, on claude.ai and in Claude Desktop alike. A server on localhost, on a private corporate network or VPN, or behind a firewall that blocks Anthropic's IP ranges can't be reached. Servers listed in Claude Desktop's claude_desktop_config.json are a separate, local mechanism: they run on your computer and don't appear on claude.ai.

So a server can work in Claude Code or curl and still fail as a connector, because those two connect from your machine.

"Couldn't reach the MCP server"

• The hostname must resolve to public addresses only. Claude rejects private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), carrier-grade NAT (100.64.0.0/10), loopback and link-local addresses, and any mix of public and private results. Connectors are IPv4-only, so a hostname with only AAAA records fails. Check with dig +short from outside your network.
• A CDN, WAF, bot rule or rate limiter can block Anthropic before the request reaches the server. Look for 403 or 429 responses at the edge that the server didn't send, and allowlist Anthropic's published IP range.
• For a server that needs sign-in, missing OAuth discovery documents can surface as this error too. /.well-known/oauth-protected-resource should return 200 with JSON, and the authorization server needs a registration_endpoint, Client ID Metadata Document support, or a client ID you enter.
• A server inside a private network can connect through an MCP tunnel instead of being opened to the internet.

"Authorization with the MCP server failed" or a sign-in that won't stick

• Register the URL the server answers on. If it redirects to another host (apex to www, region routing, a vanity domain), Claude drops the Authorization header on the redirect, the target answers 401, and sign-in fails. curl -sI <url> shows the 3xx status and its Location.
• Claude waits up to 10 seconds for the server's discovery, registration and token endpoints, and 30 seconds for refresh requests. A slow token endpoint fails the sign-in even if it issues a token later.
• Every sign-in uses PKCE with S256, and Claude sends an RFC 8707 resource parameter set to the server URL. An authorization server without S256, or one that issues tokens for another audience, fails at this step.
• If Claude loses access later, the connector shows Reconnect under Customize > Connectors. Click it and sign in again.
• Authentication settings can't be edited after you add a connector. To switch between sign-in and a header, or change OAuth details, remove the connector and add it again.
• A failed connection or sign-in on claude.ai carries a reference ID starting with ofid_ in the error and the page URL. The server's owner can report it, with server logs, on the anthropics/claude-ai-mcp issue tracker. The ID expires, so report soon.

Connected, but Claude doesn't use it

• Connectors are switched on per conversation. Click + in the message box, choose Connectors, and turn the connector on.
• On the connector's page under Customize > Connectors, Tool permissions set each tool to Always allow, Needs approval or Blocked. A blocked tool never runs.
• On Team and Enterprise plans, only an Owner adds custom connectors (on Enterprise, also a custom role that manages Libraries), in Organization settings > Connectors. Members then click Connect on the connector labeled Custom.
• The Free plan allows one custom connector.
• Request headers, for servers that take an API key, are in beta for a limited set of organizations. Claude sends the value exactly as typed, so an Authorization header needs Bearer and a space before the key. On an OAuth connection, Authorization can't be a request header.

Claude Desktop's local servers

Servers in claude_desktop_config.json (Settings > Developer > Edit Config) run on your computer and load when Claude Desktop starts, so quit it completely and reopen it after editing. Check the JSON syntax and use absolute paths, not relative ones.

Claude Desktop writes MCP logs to ~/Library/Logs/Claude on macOS, %APPDATA%\Claude\logs on Windows and ~/.config/Claude/logs on Linux. mcp.log covers connections and failures, and mcp-server-<name>.log holds each server's stderr. On macOS, tail -n 20 -f ~/Library/Logs/Claude/mcp*.log follows them as you retry.

Taskhold-specific checks

Taskhold's connector URL is https://taskhold.com/api/mcp. When it won't connect, check these in order:

1. The URL is exactly https://taskhold.com/api/mcp. The www address answers with a 308 redirect to it, which is the redirect case above.
2. Sign-in is the default. Add the connector with the URL, click Connect, sign in to Taskhold if asked, and click Allow. Taskhold signs you in with an emailed link; open it in the browser you started in, and it brings you back to the Allow page.
3. No active plan? Instead of Allow, Taskhold shows a page to start the 7-day trial. Start it, then click Connect again.
4. With a key instead (Authentication set to No sign in, and a request header Authorization with Bearer and an atd_sk_ key), Taskhold's 401 names the cause: missing_key, bad_header, not_a_taskhold_key or unknown_key. A 402 means the key works but the trial ended or the plan was canceled.
5. The connection appears in Taskhold under Settings > API keys. Revoking it there disconnects Claude; connect again to make a new one.

Once it's connected, turn the connector on in the chat and ask Claude to file or check tasks. What Claude files and what your coding agents report shows on the live board. Claude Code signed in with the same Claude account lists claude.ai connectors in /mcp. For the coding side, see Claude Code MCP server not connecting and the Claude Code page.