I burnt several hours getting this to work -- hope it helps anyone else wrangling with it!

Actually I was going to just use Prefect Horizon, but I wasn't even able to sign-up. Maybe it was a blessing in disguise though, since now I think I understand the MCP + OAuth 2.1 handshake a lot better.