<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D5WR00002GGgyp0ADOkta Classic EngineIntegrationsAnswered2026-10-13T01:59:20.000Z2026-10-12T09:33:21.000Z2026-10-13T01:59:20.000Z

WayneW.69684 (Customer) asked a question.

October 12, 2026 at 9:33 AM

Does OIW Custom App Provisioning OAuth support PKCE?

Hi Team,

I created a custom application using OIW and enabled Provisioning with OAuth 2.0 Authorization Code flow.

When clicking "Authenticate" for API Integration, Salesforce China (sfcrmproducts.cn) returns:

error=invalid_request

error_description=missing required code challenge

Salesforce now requires PKCE and it cannot be disabled.

 

My questions:

1. Does OIW custom app provisioning OAuth support PKCE?

2. If yes, where can PKCE be configured?

3. If not, is there any roadmap or EA/Beta support planned?

 

Note:

This is a custom OIW-created application, not the standard Salesforce.com OIN connector.

Thanks.

  • 2 answers
  • 43 views

  • Paul S. (Okta, Inc.)

    Hello @WayneW.69684 (Customer)​ Thank you for posting on our Community page!

     

    You are asking whether the OAuth 2.0 Authorization Code provisioning flow for your custom OIW application supports Proof Key for Code Exchange (PKCE), where PKCE is configured, and whether a roadmap or Early Access (EA) or Beta option exists, because Salesforce China (sfcrmproducts.cn) now rejects the Authenticate request with "missing required code challenge."

     

    Okta supports PKCE for Salesforce API provisioning through a "PKCE Enabled" setting on the application's Provisioning tab, and that setting resolves the error once the Salesforce connected app also requires PKCE.

    • Does OIW custom app provisioning OAuth support PKCE?

    Yes. Okta supports PKCE for Salesforce provisioning through the "PKCE Enabled" setting. Okta Support can confirm that this setting is available for your specific custom OIW application.

    • Where can PKCE be configured?

    Configure PKCE in both Salesforce and Okta:

    1. Log in to Salesforce China as a System Administrator, navigate to Setup, and search for App Manager in Quick Find.
    2. Edit the connected app used for Okta provisioning. Under the API (Enable OAuth Settings) section, check Require Proof Key for Code Exchange (PKCE) Extension, and click Save.
    3. In the Okta Admin Console, go to Applications > Applications and select your application.
    4. Open the Provisioning tab, select Integration in the left-hand settings menu, and click Edit.
    5. Check the PKCE Enabled box.
    6. Click Re-authenticate with Salesforce.com. In the Salesforce window that opens, sign in with System Administrator credentials and click Allow.
    7. Return to the Okta Admin Console and click Save.

     

    If the PKCE Enabled checkbox does not appear for your custom OIW application, contact Okta Support so the team can confirm eligibility and the supported configuration path for that application.

     

    Thank you for reaching out to our Community and have a great day!

    --

    Help others in the community by liking or hitting Select as Best if this response helped you.

    Expand Post
    Selected as Best

  • Paul S. (Okta, Inc.)

    Hello @WayneW.69684 (Customer)​ Thank you for posting on our Community page!

     

    You are asking whether the OAuth 2.0 Authorization Code provisioning flow for your custom OIW application supports Proof Key for Code Exchange (PKCE), where PKCE is configured, and whether a roadmap or Early Access (EA) or Beta option exists, because Salesforce China (sfcrmproducts.cn) now rejects the Authenticate request with "missing required code challenge."

     

    Okta supports PKCE for Salesforce API provisioning through a "PKCE Enabled" setting on the application's Provisioning tab, and that setting resolves the error once the Salesforce connected app also requires PKCE.

    • Does OIW custom app provisioning OAuth support PKCE?

    Yes. Okta supports PKCE for Salesforce provisioning through the "PKCE Enabled" setting. Okta Support can confirm that this setting is available for your specific custom OIW application.

    • Where can PKCE be configured?

    Configure PKCE in both Salesforce and Okta:

    1. Log in to Salesforce China as a System Administrator, navigate to Setup, and search for App Manager in Quick Find.
    2. Edit the connected app used for Okta provisioning. Under the API (Enable OAuth Settings) section, check Require Proof Key for Code Exchange (PKCE) Extension, and click Save.
    3. In the Okta Admin Console, go to Applications > Applications and select your application.
    4. Open the Provisioning tab, select Integration in the left-hand settings menu, and click Edit.
    5. Check the PKCE Enabled box.
    6. Click Re-authenticate with Salesforce.com. In the Salesforce window that opens, sign in with System Administrator credentials and click Allow.
    7. Return to the Okta Admin Console and click Save.

     

    If the PKCE Enabled checkbox does not appear for your custom OIW application, contact Okta Support so the team can confirm eligibility and the supported configuration path for that application.

     

    Thank you for reaching out to our Community and have a great day!

    --

    Help others in the community by liking or hitting Select as Best if this response helped you.

    Expand Post
    Selected as Best

  • WayneW.69684 (Customer)

    Thank you for your professional and prompt solution. We will reach out to support for help.

Loading
Does OIW Custom App Provisioning OAuth support PKCE?