[Claude Code] SDK auth failed: The operation timed out — api.figma.com/.well-known/oauth-authorization-server returns ERR_EMPTY_RESPONSE

Question

Environment- OS: Windows 11- Claude Code version: 2.1.156- MCP registration: claude mcp add --scope user --transport http figma https://mcp.figma.com/mcp-ProblemWhen attempting to authenticate Figma MCP in Claude Code (/mcp → figma → Authenticate), the following error appears immediately without any browser popup:SDK auth failed: The operation timed out.No browser window opens at any point during the flow.-Debugging steps I tookStep 1 — Confirmed MCP server itself is reachableSending a raw JSON-RPC initialize request to https://mcp.figma.com/mcp returns HTTP 401 with the expected www-authenticate header:www-authenticate: Bearer resource_metadata="https://mcp.figma.com/.well-known/oauth-protected-resource",  scope="mcp:connect",  authorization_uri="https://api.figma.com/.well-known/oauth-authorization-server"The MCP server is up and correctly signaling that OAuth is required. ✅Step 2 — Traced the OAuth discovery endpointClaude Code needs to fetch https://api.figma.com/.well-known/oauth-authorization-server to build the authorization URL before opening a browser. I tested this endpoint directly:- Browser: ERR_EMPTY_RESPONSE — server estabends no data- Node.js: ECONNRESET — same behavior- curl: Empty reply from server after ~60 seconds — TLS renegotiation occurs twice, then connection closes with no response bodyMeanwhile, https://api.figma.com/ (root) returns a normal 302 redirect to https://www.figma.com/developers. So api.figma.com is not fully down — only the /.well-known/oauth-authorization-server path is broken.Step 3 — Ruled out local causes- Tried adding "BROWSER": "cmd.exe /c start" to Claude Code settings — no change (browser popup never fires becausethe OAuth discovery step fails before the br- Verified Node.js TLS handshake succeeds with mcp.figma.com — the issue is strictly with the /.well-known/ endpoint on api.figma.com-Root cause hypothesisapi.figma.com/.well-known/oauth-authorization-server appears to be non-functional — it accepts a TLS connection butnever sends an HTTP response, causing Claudeout during the discovery phase, before abrowser can be opened or any token exchange can occur.This seems to match reports in this thread ae is server-side.-RequestCould the Figma team confirm:1. Is api.figma.com/.well-known/oauth-authorturn a JSON response per RFC 8414?2. Is there a known ETA for a fix?3. Is there any workaround — e.g., a static authorization endpoint URL that Claude Code could be configured to use directly?

Jaycee Lewis · Answer

Hey hey @aram_hyundai🤩Thanks for thedebugging on this — the curl trace you shared is exactly what I needed.I ran the same request against api.figma.com/.well-known/oauth-authorization-server from my end and it returned a normal HTTP/2 200 with the expected JSON body on a single clean TLS 1.3 handshake. That tells me the endpoint itself is healthy in production, which is good news, but it means something between your machine and Figma is interrupting that specific request.My response% curl -v https://api.figma.com/.well-known/oauth-authorization-server* Host api.figma.com:443 was resolved.* Trying :443...* Connected to api.figma.com port 443* ALPN: curl offers h2,http/1.1* (304) (OUT), TLS handshake, Client hello (1):* (304) (IN), TLS handshake, Server hello (2):* (304) (IN), TLS handshake, Certificate (11):* (304) (IN), TLS handshake, CERT verify (15):* (304) (IN), TLS handshake, Finished (20):* (304) (OUT), TLS handshake, Finished (20):* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256* ALPN: server accepted h2* Server certificate:* subject: CN=*.figma.com* subjectAltName: host "api.figma.com" matched cert's "*.figma.com"* issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M04* SSL certificate verify ok.* using HTTP/2> GET /.well-known/oauth-authorization-server HTTP/2> Host: api.figma.com> User-Agent: curl/8.7.1> Accept: */*>* Request completely sent off< HTTP/2 200< content-type: application/json; charset=utf-8< content-length: 647< cache-control: no-cache, no-store< x-content-type-options: nosniff< strict-transport-security: max-age=31536000; includeSubDomains; preload{"issuer":"https://api.figma.com","authorization_endpoint":"https://www.figma.com/oauth/mcp","token_endpoint":"https://api.figma.com/v1/oauth/token", ...647 bytes of valid RFC 8414 JSON... }The clue is in your trace: the TLS layer renegotiates twice and then the connection closes before any response body arrives.Could you try one thing: run the exact same curl (and the Claude Code /mcp → Authenticate flow) from a different network. Aphone hotspot is perfect, or fully off any corporate VPN/proxy. If it works off-network, we've found it, and I can point you at the right settings to get that path allowlisted. If it still fails on a clean network, let me know and I'll dig further. Talk soon! — Jaycee

Sign up

Login with SSO

Login to the community

Login with SSO