When adding a custom external MCP server in the App Center (MCP Servers → Add Custom MCP Server), the OAuth authentication method fails to connect to servers that use public OAuth 2.1 with PKCE and no client secret.

Steps to reproduce:

Go to App Center → MCP Servers → Add Custom MCP Server

Set connection type to "For all members"

Enter server URL: xxxx

Select OAuth as the authentication method

In Advanced Configuration, enter Client ID: xxxx, leave Client Secret blank

Attempt to connect

Result: "Authorization failed: Invalid Request — The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Error code: invalid_request"

Expected behavior: ClickUp's OAuth flow should support public clients using PKCE (code_challenge / code_challenge_method parameters) without requiring a client secret, per the MCP specification's OAuth 2.1 requirement.

Impact: Any MCP server that follows the spec's recommended public OAuth 2.1 + PKCE pattern (Lovable, and likely others as this becomes the standard) cannot be connected to ClickUp as an external MCP server. This is a growing pattern across the MCP ecosystem.