I'm trying to link a namespace to my Dev Hub org so I can build a second-generation (2GP) managed package. When I click Link Namespace on the Namespace Registries tab, the OAuth popup immediately returns:
error=invalid_request&error_description=missing required code challenge
The popup is the internal Environment Hub authorization flow (the redirect URL ends in /environmenthub/soma-callback.apexp). It looks like the flow requires a PKCE code_challenge that it isn't sending.
What I've already tried:
- "Require Proof Key for Code Exchange (PKCE) for Supported Authorization Flows" is OFF in both the Dev Hub org and the namespace org (Setup > OAuth and OpenID Connect Settings).
- Reproduced in Chrome and Firefox, with third-party cookies allowed and popup blockers disabled.
- Confirmed no other Salesforce sessions were open in the browser.
Environment:
- Both orgs are Developer Edition, instance USA1044, created August 2026.
- Dev Hub and "Enable Unlocked Packages and Second-Generation Managed Packages" are enabled on the hub org.
- The namespace is registered in the separate (non-Dev-Hub) org.
Has anyone hit this since the Summer '26 PKCE enforcement? Is there a connected-app or Environment Hub setting I'm missing, or is a support case the only way to link the namespace?
