[Auth/Connect]: ChatGPT rejects Salesforce Sandbox Hosted MCP because discovery metadata omits PKCE S256

ChatGPT Custom App Connection creation flow rejects a Salesforce Sandbox Hosted MCP server during connector creation with:

> Error creating connector
> OAuth authorization server metadata must advertise PKCE support with code_challenge_methods_supported containing S256.

Is this a known Hosted MCP OAuth discovery issue, and is there a Salesforce-side workaround?

### Context

We are testing a custom Hosted MCP server in a Salesforce Sandbox/UAT org

The External Client App is configured according to the Salesforce Hosted MCP documentation:

- OAuth enabled
- Scopes: `mcp_api`, `refresh_token`
- Authorization Code and Credentials Flow enabled
- PKCE required
- JWT-based access tokens for named users enabled
- Web Server Flow secret requirement disabled
- Refresh Token Flow secret requirement disabled

The ChatGPT app is configured as a User-Defined OAuth Client using standard OAuth, not OIDC. We tested both blank and populated client-secret configurations with the same result.

### Reproduction

1. Create and activate a custom Hosted MCP server in a Salesforce Sandbox.
2. Configure an External Client App using the Salesforce Hosted MCP instructions.
3. Create a ChatGPT custom app using the Salesforce sandbox authorization and token endpoints.
4. Attempt to create the connector.

The connector fails before the Salesforce login or token-exchange step.

### Discovery behavior observed

The protected-resource metadata for the Hosted MCP resource identifies:

```json
{
"authorization_servers": ["https://test.salesforce.com"]
}
```

The Salesforce sandbox OpenID discovery document at:

```text
https://test.salesforce.com/.well-known/openid-configuration
```

returns successfully but does not include:

```json
"code_challenge_methods_supported": ["S256"]
```

The Salesforce Hosted MCP-specific authorization metadata path appears to advertise:

```json
"code_challenge_methods_supported": ["S256"]
```

This suggests that the MCP-specific metadata supports PKCE, but the protected-resource discovery chain directs clients to the generic Salesforce sandbox metadata, which does not advertise S256.

### Expected behavior

The Salesforce Hosted MCP discovery chain should expose authorization metadata that advertises S256, allowing OAuth Authorization Code + PKCE clients such as ChatGPT to complete connector creation.

### Questions

1. Is this a known Salesforce Hosted MCP discovery or metadata issue?
2. Should the protected-resource metadata direct clients to the MCP-specific authorization metadata path?
3. Is there an ECA or Salesforce org setting that causes the generic sandbox metadata to advertise S256?
4. Is there a current Salesforce workaround or hotfix?

This issue is not requesting that PKCE be disabled.

References:

- Salesforce Hosted MCP ChatGPT setup:
https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/chatgpt.html
- Salesforce Hosted MCP OAuth/Postman setup:
https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/postman.html
- OpenAI MCP OAuth requirements:
https://developers.openai.com/plugins/build/auth
- Related Salesforce issue #24:
https://github.com/forcedotcom/mcp-hosted/issues/24
- Related Salesforce issue #44:
https://github.com/forcedotcom/mcp-hosted/issues/44

Start by comparing the protected-resource metadata and the Salesforce sandbox OpenID discovery document at https://test.salesforce.com/.well-known/openid-configuration with the Hosted MCP-specific authorization metadata path, then review related issues #24 and #44. Done means the discovery chain and any Salesforce-side setting or workaround are documented, including whether ChatGPT can observe S256 without disabling PKCE.

Written by the indexing model from the issue text.