Issue Summary

Connecting an external MCP server through Connected Apps can complete browser authorization successfully but then fail before tools are loaded.

The failure occurs when the authorization code is exchanged for an access token. The external OAuth provider returns:

401 invalid_client

This affects OAuth providers that require confidential-client authentication during token exchange while also supporting or requiring PKCE.

Steps to Reproduce

1. In Atlassian Administration, configure an external MCP server that supports OAuth Dynamic Client Registration.
2. Use an OAuth provider that requires a client secret for the authorization-code token exchange.
3. Complete the OAuth authorization flow through Connected Apps.
4. Return to the Connected Apps tool-selection screen.

Expected Results

When a dynamically registered OAuth client has a stored client secret, outbound-auth should include that secret in the authorization-code token request, even when PKCE is enabled. The token exchange should then complete and the MCP tools should load.

Actual Results

The connection returns to the tools page in an unauthorized or disconnected state. Tools are not loaded.
The OAuth completion flow reports a token-exchange error with 401 invalid_client.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available