How to Fix Claude Design MCP 403 FIRST_PARTY_AUTH_REJECTED in Claude Code

Claude Code users connecting to the first-party Claude Design MCP server can run into an HTTP 403 error with the message FIRST_PARTY_AUTH_REJECTED.

A typical error looks similar to this:

FIRST_PARTY_AUTH_REJECTED

api.anthropic.com rejected your claude.ai login for Claude Design (HTTP 403),
most likely because a /login token carries no Claude Design access.
Run /design-login and retry.

The error can be confusing because Claude Code itself may already be logged in successfully. Running /login again may make no difference, and older Claude Code builds may say that /design-login is unavailable.

The available evidence points to a separate authorization requirement for Claude Design. Design MCP expects Design-specific OAuth permissions that may not be present in a normal Claude Code login token.

Anthropic has since added /design-login to the current Claude Code command reference, so updating Claude Code and using that command is now the first fix to try. There are still open reports involving the underlying Design MCP authentication flow, so a persistent 403 after the current login process may require an Anthropic-side fix.

What the FIRST_PARTY_AUTH_REJECTED Error Means

The Claude Design MCP endpoint is:

https://api.anthropic.com/v1/design/mcp

Reports in Anthropic’s official Claude Code GitHub repository show that the endpoint can request these OAuth scopes:

user:design:read
user:design:write

A normal Claude Code login can have other permissions without those Design scopes. Affected users reported tokens containing permissions related to inference, profile access, MCP servers, file uploads, and Claude Code sessions while the two Design permissions were missing.

You can see one of those reports in Anthropic Claude Code issue #92215.

The resulting authentication flow can look like this:

Claude Code /login
        |
        v
Normal claude.ai OAuth token
        |
        v
Design scopes are missing
        |
        v
Claude Design MCP rejects the credential
        |
        v
HTTP 403 FIRST_PARTY_AUTH_REJECTED

This explains why another normal /login may leave the error unchanged.

Anthropic Now Documents /design-login

The current Claude Code command reference lists:

/design-login

Anthropic describes it as the command used to authorize design-system access for /design-sync.

The same command reference also includes:

/design
/design-login
/design-sync

This is relevant to older reports because some affected installations did not expose /design-login at all.

The Stack Overflow case behind this issue was using Claude Code 2.1.252. By September 28, 2026, Anthropic had released Claude Code 2.1.284. The newer command set is one reason users on 2.1.252 should update before changing MCP configuration or attempting manual token workarounds.

You can check the current Claude Code releases in the official Anthropic repository.

Step 1: Check Your Claude Code Version

Open a terminal and run:

claude --version

If you are still using a build such as 2.1.252, update Claude Code:

claude update

Close existing Claude Code sessions after the update. Then start a fresh session:

claude

Do not assume that an already running Claude process has picked up the new binary or command set.

Claude Code 2.1.284 also added:

/mcp reconnect all

That command can be useful later when retrying MCP servers after authentication changes.

The 2.1.284 release notes do not specifically say that FIRST_PARTY_AUTH_REJECTED or the Claude Design scope issue has been fixed. Updating is still the correct first step because older builds may lack the current Design login path.

Step 2: Confirm Which Claude Account Claude Code Is Using

Run:

claude auth status

Check that Claude Code is connected to the claude.ai account where you expect Claude Design to be available.

This matters if you use several Claude accounts, work accounts, API environments, or cloud-hosted Claude services.

According to Anthropic’s Claude Design documentation, Claude Design beta is available on Pro, Max, Team, and Enterprise plans. Anthropic says it is enabled by default for Pro, Max, and Team. Enterprise availability can depend on organization settings.

A Max subscription should therefore normally qualify for Claude Design, but product access and the OAuth scopes presented to a particular MCP request are separate parts of the authentication process.

Step 3: Test From a Direct Claude Code Session

Start Claude Code directly from a terminal:

claude

Use a normal interactive Claude Code session for the first test.

Anthropic documents restrictions around /design-sync when Claude Code is running through some third-party or cloud environments. The command requires access to claude.ai and is not available through environments listed by Anthropic such as Amazon Bedrock, Google Cloud’s Agent Platform, Microsoft Foundry, Claude Platform on AWS, and Claude apps gateway setups.

If you are diagnosing the 403 error, test with the normal claude.ai subscription login before involving one of those environments.

Step 4: Run /design-login

Inside the interactive Claude Code session, run:

/design-login

Complete the browser authorization using the same Claude account that has Claude Design access.

The purpose of this command differs from the general Claude login.

/login handles the normal Claude Code account session.

/design-login is documented for authorization related to design-system access and /design-sync.

After the browser flow completes, exit Claude Code and open a fresh session.

Step 5: Reconnect Claude Design MCP

Inside Claude Code, run:

/mcp

Check the Claude Design server and reconnect it if needed.

On a recent Claude Code version, you can also try:

/mcp reconnect all

From a normal shell, inspect the configured MCP servers with:

claude mcp list

The Design connection should stop returning the 403 once Claude Code has a valid authorization accepted by the endpoint.

Do Not Keep Repeating /login

If the main Claude account is already authenticated correctly, repeated logout and login cycles may not add the missing Design permissions.

Users have reproduced the Design 403 after successfully logging back into Claude Code. A Windows-related report in issue #93381 describes a similar case where Design access and the MCP credential did not line up as expected.

Use the commands according to the type of authentication you are trying to repair:

General Claude Code login:
 /login

Claude Design authorization:
 /design-login

If /design-login succeeds and the endpoint still returns FIRST_PARTY_AUTH_REJECTED, the problem has moved beyond a normal Claude account login failure.

Check for Duplicate Claude Design MCP Entries

Some users added Claude Design manually while testing the service:

claude mcp add --transport http claude-design https://api.anthropic.com/v1/design/mcp

Repeated testing can leave several entries pointing to the same server.

Check them with:

claude mcp list

Then inspect the entry you expect Claude Code to use:

claude mcp get claude-design

You may find entries with names such as:

claude-design
claude-design-test
design

Remove obsolete test entries rather than debugging several copies:

claude mcp remove claude-design-test

Claude Code can load MCP configuration from different scopes, including project and user configuration. Duplicate definitions can make authentication troubleshooting harder because the server you think you are testing may differ from the one Claude Code actually loaded.

Why claude mcp login May Not Open OAuth

For a normal remote MCP server, Claude Code supports:

claude mcp login SERVER_NAME

The Claude Code MCP documentation describes this as the command for starting a server’s OAuth login flow.

Claude Design has caused a different result in affected builds.

Users reported running:

claude mcp login claude-design

and being told that the first-party Design server authenticates through the existing Claude login. No separate browser authorization started.

That behavior creates a dead end when the existing Claude token lacks the Design scopes expected by the endpoint.

The problem is documented in Claude Code issue #95864, which remains one of the most useful technical reports for this failure.

The OAuth Discovery Problem Behind Some Design MCP Failures

The Design authentication problem has also involved OAuth discovery.

Testing reported in Anthropic’s GitHub tracker found that the Claude Design MCP endpoint advertised the required scopes:

user:design:read
user:design:write

It also pointed clients toward an authorization service under:

https://claude.ai/v1/design/mcp

The standard OAuth authorization-server metadata locations tested in that report returned HTTP 404:

https://claude.ai/.well-known/oauth-authorization-server/v1/design/mcp

https://claude.ai/v1/design/mcp/.well-known/oauth-authorization-server

An OpenID Connect metadata document was available at:

https://claude.ai/v1/design/mcp/.well-known/openid-configuration

According to the issue report, that metadata exposed the Design scopes along with authorization-code flow, refresh-token support, PKCE, and client registration information.

This can explain cases where Claude Code knows that the Design server needs extra authorization but fails to complete the normal MCP OAuth discovery path.

An earlier report also documented an authorization attempt ending at an obsolete endpoint and returning HTTP 410. See issue #77620.

Can You Manually Add user:design:read and user:design:write?

Anthropic does not currently document a command such as:

claude auth add-scope user:design:read

There is also no documented Claude account control for manually adding these scopes to a normal Claude Code subscription token.

The supported command exposed in the current Claude Code documentation is:

/design-login

For that reason, editing stored OAuth credentials or copying tokens from browser sessions is a poor troubleshooting path. It depends on undocumented credential formats and can expose account tokens.

Do not post access tokens, refresh tokens, cookies, authorization headers, or credential files when reporting the problem.

An Advanced OAuth Discovery Test

Current Claude Code MCP configuration supports an OAuth option named:

authServerMetadataUrl

Anthropic documents it as a way to provide authorization-server metadata directly when normal OAuth discovery does not work.

The same MCP configuration format also supports explicitly requested scopes.

Based on the metadata identified in the Design MCP issue reports, an experimental configuration could look like this:

{
  "mcpServers": {
    "claude-design": {
      "type": "http",
      "url": "https://api.anthropic.com/v1/design/mcp",
      "oauth": {
        "authServerMetadataUrl": "https://claude.ai/v1/design/mcp/.well-known/openid-configuration",
        "scopes": "user:design:read user:design:write"
      }
    }
  }
}

Treat this as a diagnostic test.

Anthropic documents authServerMetadataUrl and custom OAuth scopes for MCP servers generally. Anthropic does not currently document this exact JSON configuration as the official Claude Design setup.

A separate first-party credential-selection problem can also remain after metadata discovery succeeds. Some reports show Claude Code choosing its existing first-party Claude credential instead of a separately obtained MCP credential.

Use the standard /design-login path first.

What to Do If /design-login Is Still Unavailable

After updating Claude Code, run:

claude --version

Confirm that the shell is launching the newly installed binary.

Then check the installation with:

claude doctor

Inside Claude Code, you can also use:

/doctor

Look for an older Claude binary earlier in PATH, duplicate installations, unsupported authentication environments, or configuration problems.

Start the test from a direct terminal session authenticated to claude.ai. Restart the terminal after updating if there is any doubt about which executable is running.

The current Claude Code command reference lists /design-login. A recent direct Claude Code installation that still cannot expose it deserves separate investigation rather than repeated token resets.

Is Claude Code 2.1.284 a Confirmed Fix?

No confirmed release-note entry says that Claude Code 2.1.284 fixes every Claude Design MCP authentication problem.

Anthropic released 2.1.284 on September 28, 2026. Its release notes contain MCP-related changes, including the new reconnect command, but they do not name FIRST_PARTY_AUTH_REJECTED, missing Design OAuth scopes, or the Design authorization metadata problem as resolved.

Issue #95864 reproduced the OAuth discovery problem on Claude Code 2.1.275 and was still relevant when this article was prepared.

Issue #92215 also documents problems with the Design credential being attached to requests.

The current state is better described this way:

/design-login is now documented and available in current Claude Code documentation.

The broader Design MCP authentication problem does not have a clearly documented complete fix yet.

The Error Is Not Limited to Windows

The Stack Overflow case uses Windows 11, Claude Code 2.1.252, Git Bash, and a Claude Max subscription.

Related Design MCP authentication failures have also been reported from other operating systems in Anthropic’s repository.

A Windows-specific report is available in issue #94044. Other reports involving similar Design credential behavior were filed from macOS and Linux environments.

Git Bash can still be worth removing from the equation during testing. Open PowerShell, Windows Terminal, or another supported shell and run the same current Claude Code binary. The cross-platform reports suggest that the shell alone does not account for the Design authorization failure.

Claude Design MCP Can Be Online While Authentication Fails

The Design endpoint has returned OAuth authentication challenges when accessed without a valid credential.

That tells us the server can be reachable while Claude Code still reports an authentication failure.

A 403 in this case can mean that the credential reached Anthropic successfully but did not carry authorization accepted by the Design service.

That distinction helps separate a network or DNS problem from an OAuth permission problem.

/design, /design-login, and /design-sync Do Different Jobs

/design

The /design command creates or edits Claude Design artifacts from Claude Code.

Anthropic’s current command documentation says it requires Claude Code 2.1.265 or later, Artifacts availability, and an account where the Design template is available.

/design

/design-login

This command handles authorization needed for Design-system access.

/design-login

/design-sync

This command is for bringing a React design system or component library from a repository into Claude Design.

/design-sync

A user may therefore be able to use parts of Claude Design while a separate /design-sync or Design MCP authorization request still fails.

Temporary Options While Design MCP Authentication Is Broken

If the immediate goal is to work in Claude Design rather than specifically test MCP synchronization, Anthropic supports other ways to supply design-system material.

Its Design system setup documentation describes sources that can include a codebase or component library, connected applications, uploaded files, Figma material, brand assets, decks, and documents.

This will not repair a failed MCP authentication flow, but it can provide another route for getting source material into Claude Design while the MCP-specific issue is being investigated.

Recommended Fix Order

1. Check the installed Claude Code version with claude --version.
2. Run claude update if you are on an older release such as 2.1.252.
3. Restart the terminal and open a fresh Claude Code session.
4. Use claude auth status to verify the correct claude.ai account.
5. Test from a direct subscription-based Claude Code session rather than Bedrock, Foundry, another cloud provider, or an apps gateway.
6. Run /design-login and complete the browser authorization.
7. Restart Claude Code after the authorization completes.
8. Open /mcp and reconnect Claude Design.
9. On a current release, try /mcp reconnect all.
10. Run claude mcp list and remove obsolete duplicate Design entries.
11. If the same 403 remains, compare the behavior with the open Anthropic Design MCP authentication issues instead of repeatedly resetting the main Claude login.

What to Include in an Anthropic Bug Report

Claude Code provides:

/bug

and:

/feedback

If the problem remains after the current /design-login process, include enough environment information for Anthropic to reproduce it:

• Claude Code version
• Operating system
• Terminal or shell
• Claude authentication method
• Claude plan
• Whether /design-login appears
• Whether /design-login completes successfully
• The state shown by /mcp
• Whether the response is HTTP 401, 403, or 410
• The exact FIRST_PARTY_AUTH_REJECTED text

Never include the actual OAuth credential in the report.

Frequently Asked Questions

Does Claude Max include Claude Design?

Anthropic currently lists Claude Design beta for Pro, Max, Team, and Enterprise. Pro, Max, and Team have it enabled by default according to Anthropic’s support documentation.

Will /login add the missing Claude Design scopes?

It may refresh the normal Claude Code account session, but affected users have reported the same Design MCP 403 after a successful /login. The current Design-specific command is /design-login.

What scopes does Claude Design MCP request?

Reports from Anthropic’s official Claude Code issue tracker show:

user:design:read
user:design:write

Should I manually edit the Claude OAuth token?

No supported Anthropic documentation recommends editing a Claude subscription token to insert Design scopes. Use the documented login commands instead.

Why does claude mcp login not always open a browser?

Claude Design is treated as a first-party Anthropic MCP service. Affected Claude Code versions have sometimes tried to reuse the existing Claude login rather than starting a separate MCP OAuth flow. This behavior is part of the problem documented in the open issue reports.

Is authServerMetadataUrl the official fix?

No. The setting itself is documented for Claude Code MCP OAuth configuration. Using it with Claude Design’s OpenID metadata URL is an experimental troubleshooting option based on the currently exposed metadata, not a Design-specific fix documented by Anthropic.

Can I use /design even if Design MCP is failing?

Possibly. /design, /design-login, and /design-sync cover different parts of Claude Design. Anthropic says /design requires Claude Code 2.1.265 or newer along with the required account features.

What You Should Do Now

Anyone still using Claude Code 2.1.252 should update before spending time on token files or custom MCP OAuth configuration. The current Claude Code documentation now provides the /design-login command that older affected installations lacked.

If /design-login completes and Claude Design MCP still returns 403 FIRST_PARTY_AUTH_REJECTED, the open Anthropic reports provide strong evidence that the remaining problem can involve first-party credential selection or OAuth discovery rather than a simple account login failure.

I recommend keeping the setup on Anthropic’s documented authentication path, checking new Claude Code release notes for a specific Design MCP fix, and using manual OAuth overrides only as a controlled diagnostic test until Anthropic documents a permanent resolution.