Salesforce Hosted MCP: McpAuthorizationError after successful OAuth

### MCP server URL

https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### Transport used

streamable-http

### Client registration type

Static

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-07-15 11:00 PM CET

### Browser and OS

Chrome on Windows 11

### Describe the issue

Salesforce Hosted MCP (sobject-reads) — McpAuthorizationError after successful OAuth. OAuth login completes successfully, Salesforce issues the token, but Claude rejects the credentials immediately after. Error message: "Your account was authorized, but the integration rejected the credentials it just issued."

### Issue details

```shell
MCP server URL: https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads

Salesforce configuration verified and correct:
- External Client App with correct callback URL (https://claude.ai/api/mcp/auth_callback)
- OAuth scopes: mcp_api + refresh_token only
- PKCE enabled
- IP Relaxation set to "Relax IP Restrictions"
- Permission Set assigned to user
- sobject-reads server active

Flow IDs from multiple attempts:
ofid_ff3f343238a793c5
ofid_5c6247aa02543c6b
ofid_969a1b0f747e4df0
ofid_42e4028d14132db5

Related issues: #171, #280, #420
```

### Expected behavior

After successful OAuth login, Claude should establish a working connection to the Salesforce Hosted MCP server and show it as "Connected" in the connectors list.

### Logs from your server

```shell
No server logs available. This is a Salesforce Hosted MCP server managed by Salesforce — no direct log access. Salesforce Login History confirms OAuth token was successfully issued.
```

### Additional context

This issue appears to affect multiple users — see related issues #171, #280, #420. All have the same pattern: OAuth completes successfully on the Salesforce side, but Claude never completes the authenticated MCP handshake. This appears to be a Claude-side bug, not a Salesforce configuration issue.