Salesforce Hosted MCP (sandbox): OAuth completes successfully but claude.ai fails with "Authorization with the MCP server failed"

[markkutee]

Here's the updated bug report with all the new information added:

---

What happened?

When connecting the Salesforce Hosted MCP sandbox endpoint as a custom connector in claude.ai, the OAuth flow completes successfully (confirmed via Salesforce Setup → OAuth Usage by User), but claude.ai returns "Authorization with the MCP server failed". This has been reproduced across multiple configuration attempts including both the beta and GA endpoints.

Update 17 Apr 2026: Retested with the fully GA setup per official Salesforce documentation ([developer.salesforce.com/docs/platform/hosted-mcp-servers](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/client-connection-overview.html)) — new v1 endpoint, updated mcp_api scope replacing sfap_api, and OAuth Client ID (consumer key) now populated in claude.ai Advanced settings as required. Issue persists identically. OAuth Usage confirms token issued at 17 Apr 2026 09:14:53 EEST with use count 1, used at 09:14:54 EEST — token is being issued and touched but claude.ai never completes the authenticated MCP handshake.

What did you expect to happen?

After completing OAuth, the Salesforce MCP connector should show as Connected and MCP tools should be available in conversations.

Steps to reproduce

1. Create an External Client App in Salesforce sandbox per GA docs:
   • Callback URL: https://claude.ai/api/mcp/auth_callback
   • OAuth Scopes: mcp_api, refresh_token
   • Security: JWT-based access tokens enabled, PKCE required, all other options off
   • Permitted Users: All users may self-authorize
2. In claude.ai Settings → Connectors → Add custom connector:
   • URL: https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all
   • Advanced settings → OAuth Client ID: paste consumer key from External Client App
3. Click Connect — Salesforce OAuth completes successfully
4. claude.ai returns authorization failed error

Area

OAuth / Authentication

MCP Server

https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all (Salesforce Hosted MCP GA, sandbox)

Error messages or logs

"Authorization with the MCP server failed." 
ofid_5bfa04366863ce53, ofid_a4d0d03b203388be (original beta attempt, 13 Apr 2026)
ofid_a4d0d03b203388be, ofid_6d04c675eb49a972, ofid_ecc5d480c066d07d, ofid_70763555ebfdc06b (beta retries)
ofid_f4da8406d8ff1e36 (GA endpoint attempt, 17 Apr 2026)

Additional context

• Related to issues Custom connector shows 'Authorization failed' despite successful OAuth and working MCP connection #132, Internal MCP connector: "Authorization with the MCP server failed" after previously working #133, OAuth flow completes but Claude.ai/Desktop never sends authenticated request (ofid_d9dc0504114b48c4) #136 — same pattern of OAuth completing successfully but authenticated request never arriving at the MCP server
• The MCP endpoint is confirmed reachable — direct browser request returns {"errors":[{"message":"JWT Token is required"}]}, confirming server is up
• Tested on both beta endpoint (v1-beta.2) and GA endpoint (v1) — identical failure
• Tested with old scopes (api, sfap_api, refresh_token, einstein_gpt_api) and new GA scopes (mcp_api, refresh_token) — identical failure
• Tested without and with OAuth Client ID in Advanced settings — identical failure
• Salesforce OAuth Usage confirms token issued and used (delta of 1 second) but claude.ai never sends authenticated POST to MCP endpoint
• Anthropic support previously acknowledged this as a known "auth state synchronization lag" client-side issue (ref: support conversation 215473656764132 from related issue OAuth flow completes but Claude.ai/Desktop never sends authenticated request (ofid_d9dc0504114b48c4) #136)

[bbgit123]

Also hitting this on production Enterprise org — filed #184

[markkutee]

Updated the description as this is happening with the MCP servers GA also.

[haensfish]

Experiencing the exact same issue.

[mikeegonzales-eng]

Experiencing the same issue.

[overlord64]

Had the same issue in my prod org (Enterprise).
External app created,
I would get the oauth permissions verification screen.
Signed in fine on the SF side of things, I could see a new oauth usage on the external app.

But then failure on the Claude side to complete the connection.

Today, I followed the steps to enable the MCP server through the API Catalog in Salesforce and things connected fine.
Authentication accepted on the Claude side and was able to query my SF data and ran a couple create tests on opps and cases.

Seach "MCP Server" in SF setup
Activate the server you want to use (I did sobject-all)
Copy the URL from the drop down and use that for your Claude connection
I still had to use the external app key and secret in the connection

I recreated mine, but nothing url, key or secret changed so that was probably not necessary

[bbgit123]

Resolved for me. Salesforce GA docs have specific External Client App settings that differ from earlier guidance floating around. Posting my working config in case it helps others. Working URL: https://api.salesforce.com/platform/mcp/v1/platform/sobject-all Environment: Production Enterprise org, Claude web (paid), sobject-all server External Client App — working configuration: OAuth Scopes: • ✅ Access MCP servers (mcp_api) • ✅ Perform requests at any time (refresh_token, offline_access) Security section: • ✅ Issue JSON Web Token (JWT)-based access tokens for named users • ✅ Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows Callback URL: https://claude.ai/api/mcp/auth_callback Policies: • Permitted Users: All users can self-authorize • IP Relaxation: Relax IP restrictions The critical piece most older setup guides miss: the scope needs to be mcp_api specifically, not the generic api scope. And PKCE must be on, despite what earlier troubleshooting advice (including AI chatbot responses) suggested. Once I reconfigured per the current Salesforce docs at https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/create-external-client-app.html the connection worked on the first try. Hope this saves someone the several hours I spent chasing the wrong settings.

…

On Apr 20, 2026 at 4:40 PM -0400, overlord64 ***@***.***>, wrote: overlord64 left a comment (anthropics/claude-ai-mcp#171) Had the same issue in my prod org (Enterprise). External app created, I would get the oauth permissions verification screen. Signed in fine on the SF side of things, I could see a new oauth usage on the external app. But then failure on the Claude side to complete the connection. Today, I followed the steps to enable the MCP server through the API Catalog in Salesforce and things connected fine. Authentication accepted on the Claude side and was able to query my SF data and ran a couple create tests on opps and cases. Seach "MCP Server" in SF setup Activate the server you want to use (I did sobject-all) Copy the URL from the drop down and use that for your Claude connection I still had to use the external app key and secret in the connection I recreated mine, but nothing url, key or secret changed so that was probably not necessary — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: ***@***.***>

[anaphel]

Thanks @bbgit123
It finally worked for me (on sandbox), another important point for me was to not use https://api.salesforce.com/platform/mcp/v1-beta.2/sandbox/<server> url.

[dmakam-art]

Environment: Production (GA) endpoint - https://api.salesforce.com/platform/mcp/v1/platform/sobject-all

Summary: Hitting the same auth failure on the GA v1 endpoint, not just v1-beta.2. OAuth flow completes successfully on the Salesforce side (token issued, confirmed in Salesforce Setup → OAuth Usage by User), but claude.ai returns "Authorization with the MCP server failed."

Reference ID: ofid_5a3557e897702e0c

Setup:

• External Client App created with callback URL https://claude.ai/api/mcp/auth_callback
• Scopes: mcp_api, refresh_token
• PKCE enabled
• JWT-based access tokens enabled
• Added as a custom connector in claude.ai Settings → Connectors

[Maddie-ABP]

Same issue on production Enterprise org. Reference: ofid_f2863fc327d38e8a and ofid_c1781c46f6ce5fd4. OAuth completes successfully on Salesforce side, token confirmed issued, Claude fails to complete token exchange.