MCP expects localhost as redirect_uri

[baltic-nomster]

Hi,

I want to set up this mcp-server between my Nextcould and Open WebUI instances, both hosted via docker on the same machine. I'm using the oauth_single_audience mode and I'm able to register Open WebUI with Nextcloud as a client just fine. But when I try to go through the DCR flow as user I get "redirect_uri must be localhost for native clients" and I'm not redirected to the Nextcloud authentication page.

My env variables are:

MCP_DEPLOYMENT_MODE: 'oauth_single_audience' NEXTCLOUD_HOST: 'https://cloud.home.arpa' NEXTCLOUD_CA_BUNDLE: '/app/certs/ca-bundle.crt' NEXTCLOUD_MCP_SERVER_URL: 'http://192.168.188.3:8181' TOKEN_ENCRYPTION_KEY: 'key-here' TOKEN_STORAGE_DB: '/app/data/tokens.db'

I read that it's also possible to use claude web with this mcp, so why do I get the restriction for localhost? What would be the right approach to mitigate this problem? Any further information needed?

[cbcoutinho]

Hi @baltic-nomster - this issue is probably due to the fact that the MCP server and/or your Nextcloud instance are accessible to one another using a different hostname than what you use to connect via your MCP client, such as Claude Code.

For this reason, it's important to set the NEXTCLOUD_PUBLIC_ISSUER_URL env var, which is the URL of your publically accessible Nextcloud instance for the OAuth flow to complete correctly.

Let me know if this solves your issue, otherwise feel free to share more about your setup and I can try to help you connect to the MCP server via Claude

[baltic-nomster]

Thanks for your answer, @cbcoutinho . Unfortunately adding the env var didn't do the trick. I'll give you some more information about my setup and the problem.

I run Open WebUI, Nextcloud and the MCP-Server all via Docker on a Raspberry Pi behind a reverse proxy (with a self-signed certificate). The MCP-Server is, not as before, now also behind the reverse proxy. The services are only available within my local network, not publicly hosted. They are also all in the same docker network, so could also theoretically communicate via Dockers routing, but for clarity I did not choose to do so. I then access via browser/app from different devices.

My env vars are now:
MCP_DEPLOYMENT_MODE: 'oauth_single_audience'
NEXTCLOUD_HOST: 'https://cloud.home.arpa'
NEXTCLOUD_PUBLIC_ISSUER_URL: 'https://cloud.home.arpa'
NEXTCLOUD_CA_BUNDLE: '/app/certs/ca-bundle.crt'
NEXTCLOUD_MCP_SERVER_URL: 'https://mcp.home.arpa'
TOKEN_ENCRYPTION_KEY: 'key-here'
TOKEN_STORAGE_DB: '/app/data/tokens.db'

The docker command I use is command: ["--transport", "streamable-http", "--oauth", "--port", "8181"]

The Open WebUI would be accessible at 'https://chat.home.arpa'

On startup of the MCP-Server I get the following expected logs:
mcp-nextcloud | OAuth Configuration: mcp-nextcloud | Mode: Dynamic Client Registration mcp-nextcloud | Host: https://cloud.home.arpa mcp-nextcloud | Storage: SQLite (TOKEN_STORAGE_DB) mcp-nextcloud | Note: Make sure 'Dynamic Client Registration' is enabled in your Nextcloud OIDC app settings. mcp-nextcloud | ✓ PKCE support validated: ['S256', 'plain'] mcp-nextcloud | NEXTCLOUD_RESOURCE_URI not set, defaulting to: https://cloud.home.arpa.

I can then see a corresponding OIDC profile in the NC OIDC app:
{ "name": "Nextcloud MCP Server (Bearer)", "redirect_uris": [ "https://mcp.home.arpa/oauth/callback" ], "jwt_alg": "RS256", "type": "confidential", "client_id": "QUZLKT6AKuxBStbTlg4kgNPoJ4v2vfv27A7JmB4X5flLpnkLZFEFCx4BMr5lvezX", "client_secret": "key-here", "flow_type": "code", "dcr": true, "issued_at": 1774429607, "token_type": "jwt", "allowed_scopes": "openid profile email notes:read notes:write calendar:read calendar:write todo:read todo:write contacts:read contacts:write cookbook:read cookbook:write deck:read deck:write tables:read tables:write files:read files:write sharing:read sharing:write news:read news:write", "email_regex": "", "resource_url": "https://mcp.home.arpa/mcp" }

When I then connect my OpenWebUI to the MCP it can register as a client with NC just fine.

I can then see another new OIDC profile in NC OIDC app (not sure if this is supposed to happen):
{ "name": "Open WebUI", "redirect_uris": [ "https://chat.home.arpa/oauth/clients/mcp:nextcloud/callback" ], "jwt_alg": "RS256", "type": "confidential", "client_id": "17K52TVZukwO4dajbCpT7yJz8IHAsToIGV8PHi3d1F8jw513voB9yaobZ6Q9WhkY", "client_secret": "key-here", "flow_type": "code", "dcr": true, "issued_at": 1774431891, "token_type": "opaque", "allowed_scopes": "calendar:read calendar:write contacts:read contacts:write cookbook:read cookbook:write deck:read deck:write email files:read files:write news:read notes:read notes:write openid profile sharing:write tables:read tables:write todo:read todo:write", "email_regex": "", "resource_url": null }

When I then try to initiate the OAuth dance as a Open WebUI user I just get the aforementioned:
{"error":"invalid_request","error_description":"redirect_uri must be localhost for native clients"}

The logs of the MCP-Server indicate:
mcp-nextcloud | INFO [2026-03-25 09:52:00] uvicorn.access - 172.22.0.20:43736 - "GET /oauth/authorize?response_type=code&client_id=17K52TVZukwO4dajbCpT7yJz8IHAsToIGV8PHi3d1F8jw513voB9yaobZ6Q9WhkY&redirect_uri=https://chat.home.arpa/oauth/clients/mcp:nextcloud/callback&scope=calendar:read+calendar:write+contacts:read+contacts:write+cookbook:read+cookbook:write+deck:read+deck:write+email+files:read+files:write+news:read+notes:read+notes:write+openid+profile+sharing:write+tables:read+tables:write+todo:read+todo:write&state=f9WZWBaunQMAaYUIjMyqtXuDk8WV1E&nonce=Khqx2RgYqRs1iY9Ov1hR&code_challenge=fRCqTxwYUpekjS6r1yq0vBV6DA4b4H-qTHPE0iFnpoc&code_challenge_method=S256 HTTP/1.1" 400 mcp-nextcloud | INFO [2026-03-25 09:52:00] uvicorn.access - 172.22.0.20:43736 - "GET /oauth/authorize?response_type=code&client_id=17K52TVZukwO4dajbCpT7yJz8IHAsToIGV8PHi3d1F8jw513voB9yaobZ6Q9WhkY&redirect_uri=https%3A%2F%2Fchat.home.arpa%2Foauth%2Fclients%2Fmcp%3Anextcloud%2Fcallback&scope=calendar%3Aread+calendar%3Awrite+contacts%3Aread+contacts%3Awrite+cookbook%3Aread+cookbook%3Awrite+deck%3Aread+deck%3Awrite+email+files%3Aread+files%3Awrite+news%3Aread+notes%3Aread+notes%3Awrite+openid+profile+sharing%3Awrite+tables%3Aread+tables%3Awrite+todo%3Aread+todo%3Awrite&state=C2S7rCAVek9u7KZbEOuYdwdhYPTIG7&nonce=zOjW27PkfqYaqU4okYS6&code_challenge=c6VQXQUxNV1b-i7yIwVlO0MvryIzyaMPR9U8SXo435k&code_challenge_method=S256 HTTP/1.1" 400

I hope this outlines my problem a little clearer. Thanks for the help anyhow!

[cbcoutinho]

Hi @baltic-nomster a recent release of the MCP server has added support for more generic redirect URIs that use HTTPS. Can you try upgrading to a recent commit and test again? This was an oversight on my end, but should now be addressed