Custom MCP Server connections need PKCE (public client) OAuth 2.1 support
Evan Williams
When adding a custom external MCP server in the App Center (MCP Servers → Add Custom MCP Server), the OAuth authentication method fails to connect to servers that use public OAuth 2.1 with PKCE and no client secret.
Steps to reproduce:
Go to App Center → MCP Servers → Add Custom MCP Server
Set connection type to "For all members"
Enter server URL: xxxx
Select OAuth as the authentication method
In Advanced Configuration, enter Client ID: xxxx, leave Client Secret blank
Attempt to connect
Result: "Authorization failed: Invalid Request — The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Error code: invalid_request"
Expected behavior: ClickUp's OAuth flow should support public clients using PKCE (code_challenge / code_challenge_method parameters) without requiring a client secret, per the MCP specification's OAuth 2.1 requirement.
Impact: Any MCP server that follows the spec's recommended public OAuth 2.1 + PKCE pattern (Lovable, and likely others as this becomes the standard) cannot be connected to ClickUp as an external MCP server. This is a growing pattern across the MCP ecosystem.
Log In
David McEntire
PreciseFP MCP blocked by this exact issue.
Their server (https://app.precisefp.com/mcp
) uses OAuth with dynamic client registration, no client ID or secret. ClickUp rejects it with "The server rejected automatic client registration." The same server connects to Claude instantly with all 16 tools loaded, zero config. This is a ClickUp-side gap. DCR/PKCE support for custom MCP connections would unblock this immediately. Screenshot of the error and working Claude connection available if helpful.
Arkady Sokolov
Thank you Evan! I've got the team taking a look at this one – appreciate you flagging in detail.