Oauth TypeSpec Implementation Issue

[EMLLC-Support]

Hello.

I am implementing a declarative agent via Typespec that makes backend API calls. I place this issue as a high urgency as I feel my app will be ready for approval within the next 48 hours.

Support Requests

1. I am currently in contact with the M365 platform team but only an initial email was sent on regarding this issue. No resolution has been discussed yet. The ticket number is 2601240040000125.
2. I am in touch with the validation team regarding this issue. The ticket number is 4997806 .

Error:

1. I get the following error when I provision my agent in my tenant
2. This line appears three times in my provision logs (Once for each api action):
   Environment variable OAUTH2AUTH_REGISTRATION_ID exists. Skip creating API key.
3. AuthStatus: TokenFetchFailed — The base URL in your authentication configuration does not match the server URL in the OpenAPI spec.

What I have done Thus far:

1. I believe my app registration is completed correctly with the proper scopes
2. I believe my main.tsp Oauth block is implemented correctly and the values are propagating to my plugin.json and openapi.yaml files

Symptoms:

1. My agent does not show up in the integrated apps section of the M365 admin center (I suspect it is not properly registered)
2. My agent will not open in a local Explorer browser when i select debug in vsCode
3. The API calls are not reaching my backend.

Additional Information (Copilot's response is as follows):
Another question for you. Is this true? I fear that COpilot will send me on a 6 hour wild goose chase if I listen tits instructions here. Actual url was redacted for security reasons.

Copilot Says:
Why the mismatch is happening (the real root cause)
Your TypeSpec defines three different server URLs:

Response Actions
Code
https://api.url.ai/responses-api
Workflow Actions
Code
https://api.url.ai/workflow
Completion Actions
Code
https://api.url.ai/
But the Agents Toolkit can only create one OAuth connection per agent.

So during provisioning, the Toolkit picked one of these URLs (usually the first one it sees), and stored it as the OAuth connection’s base URL.

Then Copilot tries to call another action whose server URL does not match that base URL.

Result:

AuthError: The base URL in your authentication configuration does not match the server URL in the OpenAPI spec.

This is exactly what you’re seeing.

Here is additional context:
Yes — this log absolutely is useful, and it confirms the diagnosis with 100% certainty:

Your OAuth connection was never created.
And because of that, Copilot cannot fetch a token, which is why you get:

AuthStatus: TokenFetchFailed — The base URL in your authentication configuration does not match the server URL in the OpenAPI spec.

This error is not about APIM.
It is not about your OpenAPI.
It is not about your TypeSpec.
It is not about your launch.json.

It is entirely because the Toolkit is skipping OAuth registration.

🔥 The critical line in your logs
This line appears three times:

Environment variable OAUTH2AUTH_REGISTRATION_ID exists. Skip creating API key.

This means:

The Toolkit thinks you already have an OAuth registration
So it refuses to create a new one
But the registration does not exist in your tenant
So no OAuth connection is created
So your agent never appears in Integrated Apps
So Copilot cannot fetch tokens
So Copilot falls back to a blank OAuth config
So the base URL is empty or wrong
So you get the mismatch error
This is the entire problem.

🧠 Why your agent appears in Copilot but not in Integrated Apps
Your logs show:

teamsApp/extendToM365 executed successfully.
Microsoft 365 title acquired successfully (T_c73340ed... Redacted for security purposes).
This means:

The agent metadata was uploaded
The agent is visible in Copilot
But the OAuth connection was never created
So the agent is not visible in Integrated Apps
So authentication cannot work
This is exactly the “half-provisioned agent” state.

[microsoft-github-policy-service]

Thank you for contacting us! Any issue or feedback from you is quite important to us. We will do our best to fully respond to your issue as soon as possible. Sometimes additional investigations may be needed, we will usually get back to you within 2 days by adding comments to this issue. Please stay tuned.

[EMLLC-Support]

Ok. I actually think its an issue that can be resolved quickly. will it be possible to jump on a call with someone?

[qfai]

hi, @EMLLC-Support could you give us some link(the ticket you mentioned) and/or configuration(declarativeAgent.json) you use in your DA? From My understanding, you defines 3 openapi action in your declarativeAgent.json but you think only one action registered? and the action also return autherror? it would be nice to provide more info(like code without sensetive info)for me to understand your scenario and offer help.

[EMLLC-Support]

This is the ticket. However, I had another ticket open with the platform team as well. That support request is #2601240040000125

No.
I have three actions. All three are required. From my understanding, there I supposed to be a plugin for each action. I don't understand how that works and I need to actually speak with a person who understands it.

Right now, I have three app registrations. One for the front end, one for the 3 actions and their associated compute, and 1 for a separate authentication action. I a confused on the concept of plugins - which is different than plugin.json files. Do you have somene that I can speak with soon?