Power Platform Community Forum Thread Details

I am trying to connect my agent with Netsuite MCP server i am only getting "Failure passed to redirect url. role=1269 entity=18416 company=5038620_SB1 error=invalid_request"

Scope = mcp

✅ Redirect URI Configured

✅ Public Client enabled in Netsuite Integration record

✅ Authorization Code Grant Checked

✅ Token URL
used https://<AccId>-sb1.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools
Authorization URL *
https://<AccId>-sb1.app.netsuite.com/app/login/oauth2/authorize.nl
Token URL *
https://<AccId>-sb1.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
Refresh URL *
https://<AccId>-sb1.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
Scope : mcp

Categories:

Model context protocol

Hey @MR-23071216-0

That error maps directly to NetSuite's documented Step One (authorization endpoint) error table, and invalid_request there has one specific meaning: one or more required parameters are missing from the authorize GET request. Reference: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/subsect_158521823069.html

Two things that rules out for you: it's not the redirect URI and not your login. NetSuite only redirects the error back to your redirect URI if that URI already matches the integration record and yours did redirect, with role/entity/company populated, so the redirect URI is fine and the user authenticated. It's also not scope format, since a bad scope returns invalid_scope, not invalid_request. So scope=mcp is being accepted; the problem is a missing required parameter.

Most likely culprit given your setup: PKCE. You've enabled "Public Client" on the integration record, and for a public client NetSuite makes PKCE mandatory — code_challenge + code_challenge_method=S256 become required params. If your connector isn't emitting a code challenge (a plain auth-code custom connector usually doesn't), NetSuite sees a required parameter missing and bounces back invalid_request. Second candidate is state, which NetSuite requires with a minimum length (~22 chars) unlike most providers.

Fix path:

1. If the connector can't do PKCE, uncheck "Public Client" and run it as a confidential client with client_id + client_secret , that drops the PKCE requirement instead of fighting it. If you want to keep Public Client, you need a path that actually sends code_challenge.
2. Confirm the authorize request includes state (≥22 chars), response_type=code, client_id, and redirect_uri , any one missing throws the same error.
3. Minor: your "Token URL used" line is pointing at the MCP SuiteApp endpoint (…/services/mcp/v1/suiteapp/…), not a token URL. The token/refresh URLs below it (…/services/rest/auth/oauth2/v1/token) are the correct ones , won't cause this error but will bite at token exchange later.

Fastest way to confirm: capture the actual authorize URL the connector generates and check whether code_challenge and state are present.