The API key form is not on /sse. Claude (or any client) must run OAuth with PKCE first. The browser will open:
https://api-mcp.autorender.io/authorize?…
That page asks for your AutoRender API key. After you submit, the client gets a token and then talks to /sse (or alias /mcp).
If Claude never opens the authorize page: use your public HTTPS URL (not localhost), set MCP_BASE_URL accordingly, and set TRUST_PROXY=true behind ngrok so this server emits https:// links and correct JWT issuers.