Connect Microsoft Copilot Studio
Add the Whippy MCP server to a Microsoft Copilot Studio agent with OAuth Dynamic discovery.
Whippy works with Microsoft Copilot Studio over remote MCP (Streamable HTTP) and OAuth. Copilot Studio agents can call Whippy tools after you add the server and sign in with your Whippy account. No API key.
Official Microsoft reference: Connect your agent to an existing MCP server.
Other Microsoft Copilot products
- GitHub Copilot in VS Code — supported. See Connect VS Code. Do not use this page for that path.
- Microsoft 365 Copilot custom plugins / agentConnectors — Microsoft's Dynamic Client Registration docs require the authorization server to issue a client secret. Whippy's MCP OAuth registers public PKCE clients only (
token_endpoint_auth_methods_supported: none), so that plugin DCR path isn't supported.- Consumer Microsoft Copilot (copilot.microsoft.com / the consumer apps) — does not expose a settings UI to connect an arbitrary remote MCP server URL.
What you need
| Server URL | https://api.whippy.co/mcp |
| Transport | Streamable HTTP (remote). Copilot Studio supports Streamable only; SSE was removed after August 2025 |
| Authentication | OAuth 2.0 → Dynamic discovery (OAuth 2.1 authorization code + PKCE via Whippy Dynamic Client Registration) |
| Whippy account | Sign in and pick a workspace when prompted |
Use Dynamic discovery. Copilot Studio's Manual and Dynamic OAuth modes expect a client ID and client secret and do not use PKCE the way Whippy requires, so those modes fail against Whippy.
Add Whippy in Copilot Studio
- Open your agent in Microsoft Copilot Studio.
- Go to the Tools page.
- Select Add a tool → New tool → Model Context Protocol. The MCP onboarding wizard opens.
- Fill in:
- Server name:
Whippy(or another short label) - Server description: a clear summary of what Whippy does (contacts, messaging, campaigns, and so on). Copilot Studio uses this description to decide when to call the server.
- Server URL:
https://api.whippy.co/mcp
- Server name:
- Under authentication, select OAuth 2.0.
- Under Type, select Dynamic discovery. Copilot Studio discovers Whippy's OAuth metadata and registers itself; leave client ID, client secret, and endpoint fields empty.
- Select Create, then continue through Create a new connection / Add to agent.
- When prompted, sign in to Whippy in the browser, choose your workspace, and approve.
After the connection shows as connected, open the tool details and enable the Whippy tools your agent should use, then save.
Redirect URI Whippy allows
When Copilot Studio registers with Whippy, it uses a Power Platform consent callback on global.consent.azure-apim.net (either the shared …/redirect URL or a connector-specific …/redirect/<id> path). Whippy allows those callbacks. You don't paste a redirect URI into Whippy yourself for Dynamic discovery.
If registration fails with invalid_redirect_uri, confirm the callback host is global.consent.azure-apim.net and contact [email protected] with the exact URL from the error.
Use it
In the Copilot Studio test pane, ask in plain language:
Using Whippy, list my channels and show the last 10 messages on our main number.
Disconnect
Remove or disconnect the MCP tool / connection in Copilot Studio, then disconnect the app in Whippy under Connected apps.
Known limits
- Manual / Dynamic OAuth modes in the Copilot Studio wizard need a client secret and aren't compatible with Whippy's public PKCE registration. Recreate the tool with Dynamic discovery instead of editing credentials in place.
- Microsoft 365 Copilot plugin DCR (Enterprise token store) still requires a client secret per Microsoft's docs. Enabling that path would need Whippy to register confidential clients and return a client secret — not supported today.
- After a successful Whippy sign-in, some Copilot Studio environments have reported Power Platform-side token-store errors before tools load. If OAuth succeeds in Whippy but tools stay empty, check Microsoft's Copilot Studio / Power Platform status and connector connection manager; that failure is outside Whippy's OAuth allow-list.
Updated about 1 hour ago
