My HA Green is already available remotely using the cloudflared app. I do not have any configuration of any type in cloudflare other than the basic tunnel. Remote access to my HA is working fine otherwise and has been rock solid for several years.
I have installed the Model Context Protocol Server integration. It shows Assist as the service.
I created a new account with claude.ai (I am not using claude desktop).
I created a new connector in claude, giving the following settings:
Name = Home Assistant
Remote MCP Server URL = https://<my-remote-ha-url>/api/mcp
Under advanced settings:
OAuth Client ID = https://claude.ai
Nothing else set
Then I click connect on the connector.
The browser is directed to the remote HA where I login and complete the 2FA.
Then the browser shows "Start Over" and redirects back to Claude which shows (line breaks added for readibility):
Authorization with the MCP server failed.
You can check your credentials and permissions.
If this persists, share this reference with support: "ofid_ef9b414dcd88ac20"
I see in HA that a refresh token was created for claude under my user Security settings.
I see a notification for a failed login and the HA Core logs show the following:
2026-06-09 21:27:34.875 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 160.79.106.37 (160.79.106.37). Requested URL: '/api/mcp'. (python-httpx/0.28.1)
2026-06-09 21:27:47.858 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 109.76.104.216 (109.76.104.216). Requested URL: '/auth/login_flow/3390d337fa1885c0e6fbcd2b626e8532'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36)
2026-06-09 21:27:57.363 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 109.76.104.216 (109.76.104.216). Requested URL: '/auth/login_flow/3390d337fa1885c0e6fbcd2b626e8532'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36)
I have spent hours attempting to troubleshoot this with chatgpt.
I have double and triple checked the settings in the claude connector and recreated it multiple times.
I have confirmed any amount of settings in HA and cloudflare.
Really frustrated now as this is supposed to be one small step in my plan to integrate AI into HA so that it can help me troubleshoot other issues precisely so that I can avoid spending all of my free time putting HA logs into AI websites and going down rabbit holes with no bottom, but instead now I have to do exactly that for this step itself and its still not working
Does the integration not work with claude.ai?
Is there perhaps some bug in the implementation?
Yes, the only remote access to my HA Green is via the Cloudflared tunnel to my domain.
That tunnel is always active.
All other remote access to HA also uses this domain (but that is just the HA app on two mobile phones).
And yes, this is the same domain, and thus tunnel, that claude.ai (external) should use.
The domain is a simple https://<domain>.org with no subdomain or subdirectory. It is the only thing on this tunnel and domain (in fact the only thing I expose remotely at all).
Possibly Im not seeing some implication in your question?
Yes there is Zero way Claude.ai can reach into your cloudflare tunnel which is the only way to hit that mcp server.
Because you're not using the desktop app or Claude code. Connection form Claude.ai is not through the desktop it comes from the server side…. (consider it outside the tunnel)
Thank you for your quick responses!
Although I am sorry for being dense but I dont understand.
My thinking was that connectivity goes something like this:
Claude.ai
-> tunnel
-> HA
-> MCP server
Is this not what happens?
Claude does seem to be able to reach HA and the OAuth does complete, token is created, but then it seems like like the MCP request is rejected.
Nope Claude ai is a web property. Therefore origin is the server end. That would be Claude.ai’s server. Theyre outside the fence.
If they could hit your mcp server from there THROUGH a cloudflare hidden tunnel my friend, you'd have way worse problems.
Your options are a non tunnel public endpoint or use the desktop app and your internal IP.
I can expose mine IF I use my public (Nabu) endpoint. I cannot make it work with my internal hidden endpoint (without a purely internal addressing and internal client. Claude code for instance and a token auth) because Claude cant oauth in and don't care to maintain a stateful firewall to allow direct.
But my tunnel domain is public?
Anyone that knows the URL can browse to it get to the HA login page (and they do, but without credentials and 2FA they cannot get in I hope), just like a nabucasa remote access.
I do not have any special setting or private tunnel stuff on the mobile phones that already access HA remotely, they just use the public domain connected to that tunnel.
It is the same domain I configured in the Claude connector.
As I mentioned above also, the refresh token is created for claude so it does seem like OAuth is actually completing.
I'm obviously missing some knowledge here, so I appreciate you bearing with my questions!
Normally tunnel indicates completely blank front he internet and requires a client to connect.. My assumption when you say tunnel is the domain name and ip address are invisible.
If that's not true. Then you treat as a normal public domain. And….
Go see if this looks like what you're running into.
The most common snag here is OAuth redirect_uri mismatch. When claude.ai initiates the OAuth flow it sends a redirect_uri pointing back to claude.ai's own callback endpoint, so you need to add that exact URI to Home Assistant's authorized redirect URIs before the handshake will succeed. Check the browser DevTools network tab on the failing redirect step to see the exact URI claude.ai is sending; copy that into Home Assistant config exactly. Common causes I've seen: trailing slash mismatch, http vs https, port differences, or claude.ai using a region-specific callback that you missed. Also worth verifying: your HA instance is reachable from claude.ai (public URL or tunnel like Cloudflare), the OAuth scope is granted, and the access token is being returned with the right format. If the failure is a CORS error rather than redirect_uri, that's a different fix — HA needs claude.ai's origin in CORS allowlist. Share the exact error message from DevTools and I can help narrow it down.
