Dashboard Claude credential OAuth flow omits redirect_uri

[Avg8888]

Bug Report

Branch

dev

Branch (if other)

N/A

Version / Tag / Commit

afec625 (2026-06-20, feat(xai): enable xAI Grok device-code OAuth in admin WebUI)

Provider(s) Affected

Claude / Anthropic

Deployment Method

From source (python)

Operating System

macOS (exact version not recorded)

Python Version (if running from source)

NOT_ENOUGH_INFO

Bug Description

The dashboard / WebUI credential setup for Claude starts an OAuth flow that reaches Claude without a redirect_uri, causing Claude to reject the authorization request.

This does not happen when using the proxy itself to add credentials.

Steps to Reproduce

1. Open the LLM API Key Proxy dashboard / WebUI credentials page.
2. Add credentials for Claude / Anthropic from the dashboard.
3. Continue through the Claude authorization flow.
4. Observe Claude's OAuth error page.

Expected Behavior

The dashboard-generated Claude credential flow should include the required redirect_uri and complete authorization, matching the working proxy credential flow.

Actual Behavior

Claude shows:

Invalid OAuth Request
Missing redirect_uri parameter

Error Logs / Messages

Screenshot from the failing Claude OAuth page:

Original local screenshot path used when filing: /Users/xandru_industries/Screenshots/Screenshot 2026-06-30 at 13.34.19.png

Pre-submission Checklist

• I have searched existing issues to ensure this is not a duplicate

[claw-io]

Thanks for the detailed report — I've traced this through the source and found the root cause. This is a confirmed bug in the WebUI OAuth flow for Anthropic.

Confirmed root cause

The WebUI credential flow and the CLI credential flow build the Anthropic authorize URL differently. The WebUI flow omits a parameter that the CLI flow includes and that Anthropic's OAuth requires.

CLI flow — src/rotator_library/providers/anthropic_oauth_base.py:718–729 (this is the path that works for you):

auth_params = {
    "code": "true",  # Required by Anthropic OAuth
    "client_id": self.CLIENT_ID,
    "response_type": "code",
    "redirect_uri": self.REDIRECT_URI,
    "scope": " ".join(self.OAUTH_SCOPES),
    "code_challenge": code_challenge,
    "code_challenge_method": "S256",
    "state": state,
}
auth_url = f"{self.AUTH_URL}?" + urlencode(auth_params)

WebUI flow — src/proxy_app/api/oauth.py:502–510, the anthropic branch of _start_paste_flow (this is the path that fails):

auth_url = "https://claude.ai/oauth/authorize?" + urlencode({
    "response_type": "code",
    "client_id": auth_inst.CLIENT_ID,
    "redirect_uri": redirect_uri,
    "scope": " ".join(scopes),
    "code_challenge": challenge,
    "code_challenge_method": "S256",
    "state": state,
})

The WebUI flow is missing the "code": "true" parameter, which the CLI implementation explicitly marks as "Required by Anthropic OAuth." Both flows set the same redirect_uri (https://console.anthropic.com/oauth/code/callback) — so redirect_uri is present in both requests. The missing code parameter is what causes claude.ai/oauth/authorize to reject the request. The "Missing redirect_uri parameter" error message returned by Claude's authorize endpoint is misleading; the parameter actually missing from the WebUI request is code.

The state value also differs between the two flows (the CLI reuses the PKCE verifier as state; the WebUI generates a random token and stores it separately), but both handle state correctly for their respective flows, so that's not the cause.

What I confirmed vs. what I'm inferring

• Confirmed (from code): the code: "true" parameter is present in the CLI auth path (anthropic_oauth_base.py:719) and absent from the WebUI auth path (oauth.py:502–510). This is the only material difference between the two flows — both set the same redirect_uri, client_id, scopes, and PKCE params.
• Inferred: that the missing code parameter is what produces the specific "Missing redirect_uri parameter" error you saw. I have not reproduced the exact error string locally, but the missing code param is the only difference between the working and failing paths, and it's explicitly annotated as required in the working path. Adding it back and retesting would confirm definitively.

Fix

A one-line addition to src/proxy_app/api/oauth.py in the anthropic branch of _start_paste_flow — add "code": "true" to the urlencode dict (matching the CLI flow). The fix is identified and ready to apply; I'll track it and ship it shortly.

Workaround

Until the fix ships, you can add Claude credentials via the CLI flow instead of the WebUI — that path includes the required code parameter and works correctly.

Thanks for the clear reproduction steps and the screenshot — that made this straightforward to pin down.

[claw-io]

Thanks for the detailed report — I've traced this through the source and found the root cause. This is a confirmed bug in the WebUI OAuth flow for Anthropic.

Confirmed root cause

The WebUI credential flow and the CLI credential flow build the Anthropic authorize URL differently. The WebUI flow omits a parameter that the CLI flow includes and that Anthropic's OAuth requires.

CLI flow — src/rotator_library/providers/anthropic_oauth_base.py:718–729 (this is the path that works for you):

auth_params = {
    "code": "true",  # Required by Anthropic OAuth
    "client_id": self.CLIENT_ID,
    "response_type": "code",
    "redirect_uri": self.REDIRECT_URI,
    "scope": " ".join(self.OAUTH_SCOPES),
    "code_challenge": code_challenge,
    "code_challenge_method": "S256",
    "state": state,
}
auth_url = f"{self.AUTH_URL}?" + urlencode(auth_params)

WebUI flow — src/proxy_app/api/oauth.py:502–510, the anthropic branch of _start_paste_flow (this is the path that fails):

auth_url = "https://claude.ai/oauth/authorize?" + urlencode({
    "response_type": "code",
    "client_id": auth_inst.CLIENT_ID,
    "redirect_uri": redirect_uri,
    "scope": " ".join(scopes),
    "code_challenge": challenge,
    "code_challenge_method": "S256",
    "state": state,
})

The WebUI flow is missing the "code": "true" parameter, which the CLI implementation explicitly marks as "Required by Anthropic OAuth." Both flows set the same redirect_uri (https://console.anthropic.com/oauth/code/callback) — so redirect_uri is present in both requests. The missing code parameter is what causes claude.ai/oauth/authorize to reject the request. The "Missing redirect_uri parameter" error message returned by Claude's authorize endpoint is misleading; the parameter actually missing from the WebUI request is code.

The state value also differs between the two flows (the CLI reuses the PKCE verifier as state; the WebUI generates a random token and stores it separately), but both handle state correctly for their respective flows, so that's not the cause.

What I confirmed vs. what I'm inferring

• Confirmed (from code): the code: "true" parameter is present in the CLI auth path (anthropic_oauth_base.py:719) and absent from the WebUI auth path (oauth.py:502–510). This is the only material difference between the two flows — both set the same redirect_uri, client_id, scopes, and PKCE params.
• Inferred: that the missing code parameter is what produces the specific "Missing redirect_uri parameter" error you saw. I have not reproduced the exact error string locally, but the missing code param is the only difference between the working and failing paths, and it's explicitly annotated as required in the working path. Adding it back and retesting would confirm definitively.

Fix

A one-line addition to src/proxy_app/api/oauth.py in the anthropic branch of _start_paste_flow — add "code": "true" to the urlencode dict (matching the CLI flow). The fix is identified and ready to apply; I'll track it and ship it shortly.

Workaround

Until the fix ships, you can add Claude credentials via the CLI flow instead of the WebUI — that path includes the required code parameter and works correctly.

Thanks for the clear reproduction steps and the screenshot — that made this straightforward to pin down.