NetSuite MCP Connector — Authorization fails after successful OAuth (Claude claude.ai)

[itengineer01-wyman]

Summary:
OAuth consent completes successfully on the NetSuite side but Claude fails during the token exchange step with oauth_error=invalid_grant and error_code=mcp_token_exchange_failed. Confirmed via browser DevTools network inspection.

Environment:

• Claude plan: Teams Account
• Claude.ai (web)
• NetSuite environment: Sandbox
• MCP Server URL: https://account ID (redacted)-sb1.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools

Reference IDs (ofid codes):

• ofid_f3b3258c9c81f3f3
• ofid_dd5e2f9c3c14db04
• ofid_39887d95f914fee5
• ofid_7f089e1c7451b268

Exact error from Network tab (auth_callback 307 response Location header):

/admin-settings/connectors?installed_from_directory=true
&open_policy_details=d7733f53-723c-477a-a87b-41926580ef7d
&server=124e3328-0e4f-4935-94e1-4d4c53231433
&step=end_error
&flow_id=ofid_7f089e1c7451b268
&oauth_error=invalid_grant
&error_code=mcp_token_exchange_failed

Full OAuth flow observed in DevTools:

Request	Status	Notes
authorize.nl?redirect_uri=...	302	NetSuite redirects to consent screen ✅
auth_callback?state=...	307	Claude receives callback from NetSuite ✅
connectors?installed_from...	200	Claude processes connection ✅
auth	200	Auth request ✅
oauth_tokens?application_...	200	Token fetch attempt ✅

Everything returns success codes but the token exchange itself fails with invalid_grant.

NetSuite side confirmed correct:

• MCP Standard Tools SuiteApp installed
• Custom role (Claude Pro MCP) with MCP Server Connection + OAuth 2.0 Access Token permissions — Administrator role NOT used
• Claude AI integration record auto-created by NetSuite: State = Enabled, Authorization Code Grant ✅, Public Client ✅, Redirect URI = https://claude.ai/api/mcp/auth_callback ✅, NetSuite AI Connector Service scope ✅
• OAuth consent screen appears correctly, correct role and account shown

MCP Inspector findings (v0.21.2):

• Metadata Discovery: ✅ Passed — server reachable and responding
• Client Registration: ❌ Failed — NetSuite does not support Dynamic Client Registration (RFC 7591)

Hypothesis:
The invalid_grant error suggests one of the following:

1. Claude's redirect URI during token exchange doesn't exactly match the URI in the NetSuite integration record
2. PKCE mismatch between initial authorization request and token exchange
3. Authorization code expiring before Claude completes the exchange
4. NetSuite rejecting Dynamic Client Registration, causing the token exchange to fail

Ask:
Can someone help investigate using the ofid codes and the exact error above? The mcp_token_exchange_failed error code suggests this may be a known failure mode. Happy to provide additional screenshots or run further diagnostics.