#Generation Managed Package6 discutindo

This looks like a mismatch created by Salesforce's own PKCE enforcement rollout rather than something wrong in your org's configuration. The SalesforceDX Namespace Registry connected app is a Salesforce-owned system connected app used by the Namespace Registries Link Namespace flow, and its PKCE requirement is locked because Salesforce has been moving connected apps and External Client Apps toward mandatory PKCE, with no admin opt-out on system apps like this one. Your org-level Require PKCE toggle being off is not relevant here, since that setting only affects apps that inherit the org default, and this one has its own requirement baked in. 

The "invalid_request / missing required code challenge" error means the client side of this OAuth exchange, the Link Namespace popup itself, is not sending a code_challenge parameter even though the connected app now demands one. Since that popup is Salesforce's own UI and not something you control from Setup, you cannot fix this from your Dev Hub or Namespace org settings. Other admins have hit the same "missing required code challenge" wall on various Salesforce-owned OAuth flows since PKCE enforcement tightened, so this is worth logging as a Salesforce Support case, quoting the exact error and the Dev Hub and Namespace org IDs, so they can confirm whether it is a tracked regression tied to the PKCE rollout on that specific connected app. 

Background on PKCE enforcement:

Assumption: I cannot reproduce your Dev Hub, so I cannot fully confirm this is a Salesforce-side defect versus something specific to your org's Namespace Registry setup. This is inferred from the well-documented PKCE enforcement pattern and other reports of the same error on Salesforce-managed connected apps once PKCE became mandatory without an opt-out.

That error (missing required code challenge) means the SalesforceDX Namespace Registry connected app has PKCE enforced while the namespace-link flow is not sending a code challenge. Disable it on that specific connected app: 

Setup, App Manager, find SalesforceDX Namespace Registry, open the row dropdown, choose Edit (not Manage), go to the API (Enable OAuth Settings) section, and uncheck Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows, then Save. 

The gotcha: that checkbox is on the Edit page, not under Manage then Edit Policies, which is where most people look. Give it a couple of minutes to propagate, then retry the namespace link. 

Since PKCE is a security feature, only disable it for this app because the link needs it, and consider re-enabling once the namespace is linked. 

if this helps, please mark it as the Best Answer so it helps the next person — thanks 🙂