OAuth: issuer mismatch (RFC 9207) — resource metadata points to mcp.monid.ai but token issuer is clerk.app.monid.ai

[FvanW]

Summary

MCP client OAuth login against the Monid MCP server fails with an RFC 9207 issuer-mismatch error. The authorization server (Clerk) issues tokens from clerk.app.monid.ai, but the MCP resource metadata for https://mcp.monid.ai/v1 declares/expects issuer https://mcp.monid.ai.

Error

Couldn't complete authentication for "monid": Issuer mismatch in authorization response (RFC 9207): expected "https://mcp.monid.ai", received "https://clerk.app.monid.ai"

Client

Claude Code CLI, claude mcp login monid, HTTP transport pointed at https://mcp.monid.ai/v1.

Expected

The iss claim returned by the authorization server should match the issuer declared in the MCP server's protected-resource / authorization-server metadata (per RFC 9207 + the MCP OAuth spec), so RFC 9207-compliant clients can complete the flow.

Suggested fix

Either configure Clerk to issue tokens under the mcp.monid.ai issuer (e.g. via a custom domain/proxy), or update the resource metadata advertised at mcp.monid.ai to declare the actual Clerk issuer (clerk.app.monid.ai).

Impact

Any RFC 9207-strict MCP client (including Claude Code) cannot authenticate to the Monid MCP server at all.

[sameerkhansf]

Re the iss mismatch here. I ran mcp.monid.ai/v1 through mcpcomp today and found something more urgent. A request with no token gets 401. The same request with a bearer token your server never issued (I used a random string) gets 200, including a full tools/list. The spec says invalid tokens MUST get 401. Two curls reproduce it, happy to send them. The iss issue itself is on the callback leg, which is what our verify --interactive checks. Want both reports? I can send them today.

[FeiyouG]

Hi @FvanW and @sameerkhansf , thanks for bring this to our attention! Our team has started on addressing the issue here, and we will patch it soon

[sameerkhansf]

Re-scanned mcp.monid.ai/v1 today and the issuer mismatch this issue is about is still live: the AS metadata at https://mcp.monid.ai/.well-known/oauth-authorization-server declares issuer: "https://clerk.app.monid.ai", but discovery selected https://mcp.monid.ai, so the official MCP SDK rejects the document before it ever reaches Clerk. That's the RFC 8414 §3.3 / RFC 9207 identity requirement.

No rush since you're already on it. When the patch is live, reply here and I'll re-run the scan and confirm it's clean on the thread. One thing worth flagging for after the fix: this is a Clerk config value, not code, so it can come back the next time the Clerk setup moves. If that's useful I can point a free standing check at the endpoint that pings you the moment the issuer or metadata drifts again.

[FeiyouG]

@sameerkhansf @FvanW
We have shipped the fix for Oauth issuer mismatch error and the leaking auth for MCP tool/list APIs.