Symptom

Any MCP client configured with the APEX URL https://worldmonitor.app/mcp that hits a 401 and starts OAuth recovery fails at dynamic client registration:
Error from remote server: MethodNotAllowedError ... at registerClient (mcp-remote)

Root cause (verified live)

• /mcp is exempted from the Cloudflare apex→www redirect (POST /mcp on apex → 200 ✅), and /.well-known/oauth-authorization-server on apex serves metadata whose endpoints are HOST-DERIVED → all point at the APEX: https://worldmonitor.app/oauth/register, /oauth/token, /oauth/authorize.
• /oauth/* is NOT exempted: POST https://worldmonitor.app/oauth/register → Cloudflare 301 → https://www.worldmonitor.app/oauth/register. Fetch converts POST→GET on 301 → GET on the register endpoint → 405.
• POST https://www.worldmonitor.app/oauth/register works (201, client_id issued). Same POST→GET break applies to /oauth/token on apex.

Impact

OAuth is structurally dead for every apex-URL MCP client (mcp-remote, custom SDK clients). The 1.1k mcp_oauth 200s/24h in Axiom are all www/claude.ai-path clients.

Fix options

1. Cloudflare: extend the apex→www redirect exemption to /oauth/* (mirror the existing /mcp + /.well-known/* exemptions). Preferred — one rule, no code.
2. Alternative/belt-and-braces: pin registration_endpoint/token_endpoint/authorization_endpoint in oauth-authorization-server metadata to the canonical https://www.worldmonitor.app host instead of host-deriving (check RFC 8414 issuer-match strictness in SDK clients first).

Found while diagnosing the customer-reported prompts/list hang (sibling issue).