Product: Microsoft Copilot Studio (Web)
Scenario:
Connecting Copilot Studio Model Context Protocol (MCP) tool to Salesforce Hosted MCP Server.
Salesforce Hosted MCP Endpoint:
https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-reads
Authentication:
OAuth 2.0
Observed Error:
error=invalid_request
error_description=missing required code challenge
Configuration:
- Salesforce External Client App created
- Access Salesforce hosted MCP servers (mcp_api) scope enabled
- Authorization Code Flow enabled
- Callback URL configured to Copilot-generated redirect URL
- Consumer Key and Secret generated and configured
- OAuth redirect URL matches exactly
Observation:
Salesforce External Client App requires PKCE.
Copilot Studio MCP authentication appears not to provide the required PKCE code_challenge during authorization.
Question:
Does Copilot Studio MCP OAuth currently support Salesforce Hosted MCP Servers requiring PKCE, and if so, what is the correct OAuth configuration?
