Salesforce Hosted MCP — "Authorization with the MCP server failed" on production Enterprise org

[bbgit123]

MCP server URL or name

https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads

How are you connecting to this server?

From a custom connector URL I entered manually

Where does the issue occur?

When pressing the Connect button

When did you last reproduce this?

2026-04-16 2:00 PM EDT

Browser and OS

Arc 1.140.0 on Mac Taho 26.2

Describe the issue

Connecting Claude's custom MCP connector to a Salesforce Hosted MCP Server (sobject-reads) on a production Enterprise org. OAuth handshake completes successfully — Salesforce issues the token and OAuth Usage confirms connection — but Claude returns "Authorization with the MCP server failed" when attempting to use the token against the MCP endpoint.

This matches the pattern reported in #171 (sandbox org) but confirms the bug also affects production Enterprise orgs. Anthropic support acknowledged this as an Anthropic-side issue matching the pattern tracked in #171.

Steps to reproduce:

1. Create Salesforce External Client App per official docs at https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/claude.html
2. Configure callback URL as https://claude.ai/api/mcp/auth_callback (also tested with claude.com path added)
3. Enable MCP Service on org; activate sobject-reads MCP server
4. In Claude: Settings > Connectors > Add custom connector
5. Paste server URL and Consumer Key in Advanced settings
6. Click Connect, complete Salesforce OAuth, approve scopes
7. Salesforce OAuth Usage confirms token issued
8. Claude returns "Authorization with the MCP server failed" with ofid_ reference
   Also tested with URL https://api.salesforce.com/platform/mcp/v1-beta.2/platform/sobject-reads - same result.

Environment:

• MCP Client: Claude (Web), paid plan
• • Org Type: Production, Enterprise Edition
• • • Authentication: Authorization Code flow via Salesforce External Client App
• • • • Scopes granted: api, refresh_token (offline_access), sfap_api

Diagnostics performed:

• PKCE disabled on External Client App
• • "Require secret for Web Server Flow" disabled
• • • Permitted Users: "All users can self-authorize"
• • • • IP Relaxation: "Relax IP restrictions"
• • • • • Callback URL includes both claude.ai and claude.com paths
• • • • • • Enable Authorization Code and Credentials Flow: checked
• • • • • • • Tested in incognito mode
• • • • • • • • Deleted and recreated Claude connector multiple times
• • • • • • • • • Tested both v1 and v1-beta.2 URL paths

Error details

Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: ofid_ecd71870d1963316

Expected behavior

Claude connector should successfully connect to the Salesforce Hosted MCP server after OAuth completes, allowing use of the sobject-reads tools.

Additional context

Related issues tracking the same pattern:

• Salesforce Hosted MCP (sandbox): OAuth completes successfully but claude.ai fails with "Authorization with the MCP server failed" #171
• [Auth/Connect]: Claude custom connector can't connect to Salesforce Sandbox. forcedotcom/mcp-hosted#12

Anthropic support confirmed this is an Anthropic-side issue being tracked in #171.

[briankeare-nue]

+1, same symptom, here's my ofid: ofid_33ba944f34fcc45b. Configured as per salesforce instructions and have a token issued on salesforce front but error back in claude.

Note from the above that we included in scopes granted the mcp_api variant.

[yuvalrinot]

This is not a fix for the Anthropic bug if one exists, but it will make your connector work:
In your Salesforce external app under Security, uncheck everything and keep only the following checked:

• Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows
• Issue JSON Web Token (JWT)-based access tokens for named users

If it still does not work, try selecting "Relax IP Restrictions" under Policies.

No need to pass the secret in your connector settings, just the consumer key.

[boxerbk]

+1, hitting the same issue on a production Enterprise org. Reference: ofid_1fa1c3bc979b5e6b. OAuth handshake completes, Salesforce OAuth Usage confirms token issued, but Claude returns "Authorization with the MCP server failed" on first tool call. ECA configured per official docs with mcp_api + refresh_token scopes, PKCE enabled, JWT-based access tokens enabled.

[tomchapman-synth]

Same here, with a fresh custom mcp server and fresh external client app with PKCE and JWT based, this is with relaxed IP restrictions.

It would be useful to know if people are using custom servers with an appropriate domain url and if they're on custom domains and SSO only logins.

[briankeare-nue]

Salesforce Hosted MCP + Claude — Setup Guide

TL;DR

Salesforce's docs and most third-party guides leave out two settings that are required. Without them you'll cycle through five different OAuth errors before hitting a generic "Authorization with the MCP server failed" wall that GitHub issue #184 tracks as an Anthropic bug — except it isn't a bug, it's a missing setting.

The two missing pieces:

1. Issue JSON Web Token (JWT)-based access tokens for named users must be checked on the External Client App.
2. The MCP server itself must be explicitly Activated in Setup → API Catalog → MCP Servers, not just exist there.

Get those right plus the standard OAuth config below and connection works on the first try.

Verified working config

Step 1 — Activate the MCP server

Setup → quick find "MCP Servers" → API Catalog → MCP Servers tab. Find sobject-all (recommended, 9 tools) or sobject-reads (read-only, 6 tools). Click the row → Activate. Status flips to Active.

Step 2 — Create the External Client App (ECA, not Connected App)

Setup → External Client App Manager → New External Client App.

Basic Information:

• External Client App Name: Claude MCP <server-name> (display only)
• Contact Email: yours
• Distribution State: Local
• API (Enable OAuth Settings): checked

OAuth Settings:

• Callback URL: https://claude.ai/api/mcp/auth_callback (no trailing slash)
• Selected OAuth Scopes:
  • Access Salesforce hosted MCP servers (mcp_api) ← THIS scope, not generic api
  • Perform requests at any time (refresh_token, offline_access)

Flow Enablement:

• Enable Authorization Code and Credentials Flow ✓
• All other flows unchecked
• "Require user credentials in the POST body" unchecked

Security:

• Require secret for Web Server Flow ✗ (Claude uses PKCE, no secret)
• Require secret for Refresh Token Flow ✗
• Require Proof Key for Code Exchange (PKCE) ✓
• Issue JSON Web Token (JWT)-based access tokens for named users ✓ ← required, missed in most guides

Save.

Step 3 — Permission set

Setup → Permission Sets → New.

• Label: Claude MCP User
• Save.

Open the External Client App → Policies tab → Permission Sets section near the bottom → Manage → add Claude MCP User → Save.

Setup → Users → click your user → Permission Set Assignments → Edit Assignments → add Claude MCP User → Save.

App Authorization on the External Client App should already show "Admin approved users are pre-authorized." If not, set it on the Policies tab.

Step 4 — Wait

Wait 5 to 10 minutes after creating or editing the ECA. Salesforce propagation is slow and you'll get cryptic errors during the window.

Step 5 — Grab the Consumer Key

External Client App → Settings → OAuth Settings → click "Consumer Key and Secret" → copy the Consumer Key. Ignore the secret.

Step 6 — Add the Claude connector

Claude (web or desktop) → Settings → Connectors → Add custom connector.

• Name: Salesforce (sobject-all) or similar
• Server URL: https://api.salesforce.com/platform/mcp/v1/platform/sobject-all
  (or substitute sobject-reads if you activated that one instead)
• Advanced → OAuth Client ID: paste the Consumer Key
• Client Secret: blank
• Save → Connect → Salesforce login → approve → done.

Verification

Setup → External Client App OAuth Usage by User → click your ECA. You should see your user with Initial Connection time and a Use Count > 0. That confirms a token was issued and Claude is using it.

In Claude, ask "Show me 5 recent Salesforce accounts." Should return real records from your org.

The trap list — what blew up and how to fix each

These are the errors I hit, in order. If you see one, jump to the matching fix.

Trap 1: Click Connect downloads a file called "authorize"

OAuth Client ID field is empty in the Claude connector. Edit the connector and paste the Consumer Key.

Trap 2: code: Field required after OAuth login

Multiple OAuth misconfigs in the External Client App.

Fix: in ECA OAuth Settings, check "Enable Authorization Code and Credentials Flow," uncheck "Require secret for Web Server Flow," uncheck "Require secret for Refresh Token Flow."

Trap 3: OAUTH_APP_ACCESS_DENIED — user is not admin approved to access this app

Permission set isn't fully wired. Both pieces are required:

a. ECA → Policies tab → Permission Sets section → add Claude MCP User
b. Setup → Users → your user → Permission Set Assignments → add Claude MCP User

Doing only one isn't enough.

Trap 4: OAUTH_APPROVAL_ERROR_GENERIC : An unexpected error has occurred during authentication

Wrong OAuth scope. The generic Manage user data via APIs (api) scope does not work for hosted MCP. You need Access Salesforce hosted MCP servers (mcp_api) specifically. It's lower in the Available Scopes list, easy to miss.

Trap 5: Authorization with the MCP server failed after OAuth completes

This is the one GitHub issue #184 tracks as an Anthropic bug. It's not. Two causes:

a. JWT-based access tokens not enabled on the ECA. Check the box in OAuth Settings → Security.
b. The MCP server itself is not Activated in API Catalog → MCP Servers. Click the row, Activate it.

After fixing, revoke the existing token in External Client App OAuth Usage by User (forces a fresh token request with new settings), then retry Connect in Claude.

Other gotchas

• Connected Apps OAuth Usage page (legacy framework) does NOT show External Client Apps. To check ECA token activity, go to External Client App OAuth Usage by User specifically.
• Salesforce hosted MCP routes via Consumer Key, not URL. The api.salesforce.com URL is shared across all orgs; the Consumer Key tells Salesforce which org's ECA to use. You don't need to point at <your-org>.lightning.force.com.
• ECA changes take 5–10 minutes to propagate. Don't troubleshoot during the window.
• Postman is Salesforce's recommended smoke-test client. If Claude fails but Postman with the same Consumer Key + URL works, the bug is on Anthropic. If both fail, the bug is on your ECA config.

References

• Salesforce Configure Claude doc
• Salesforce External Client App creation doc
• GitHub issue #184 — comment thread with bbgit123's working config
• GitHub issue #171 — sandbox / production threads