Codex mcp login fails with OAuth providers that require resource (eg. MarketingCloud MCP)

What variant of Codex are you using?

App and CLI

What feature would you like to see?

Bug: codex mcp login fails with OAuth providers that require resource (MarketingCloud MCP)

Summary

codex mcp login marketingcloud-mcp starts an OAuth PKCE flow, but the generated OAuth requests appear to omit the resource parameter required by the provider.

• Without resource on the authorization request, the provider rejects the request.
• If I manually add resource to the authorization URL, browser login succeeds, but the CLI then fails on token exchange (which also appears to omit resource).

This looks like a bug/compatibility gap in MCP OAuth handling for providers that require OAuth resource indicators.

Environment

• codex-cli 0.104.0
• macOS arm64
• Date observed: 2026-02-23

MCP Server Config

• Name: marketingcloud-mcp
• URL: https://shared.marketingcloudmcp.com/mcp

Steps To Reproduce

1. Configure/register the MCP server (already configured in my case) with:

• https://shared.marketingcloudmcp.com/mcp

1. Run:

• codex mcp login marketingcloud-mcp

1. Open the browser authorization URL printed by Codex.

Expected Behavior

The OAuth login completes successfully and codex mcp login marketingcloud-mcp stores credentials.

Actual Behavior

Authorization step fails (CLI-generated URL)

Provider returns:

{"error":"invalid_request","error_description":"Missing or invalid response_type, client_id, redirect_uri, PKCE (code_challenge), or resource required","error_uri":"https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13#section-3.1.1"}

The CLI-generated authorize URL included PKCE params, client_id, and redirect_uri, but did not include resource.

Manual workaround partially succeeds, then token exchange fails

If I manually add:

• resource=https://shared.marketingcloudmcp.com/mcp

to the authorization URL, the browser flow proceeds correctly.

After completing login in the browser, the waiting CLI process fails with:

Error: failed to handle OAuth callback

Caused by:
    OAuth token exchange failed: Server returned error response: invalid_request: Missing or invalid grant_type, code, redirect_uri, client_id, PKCE (code_verifier), or resource required (see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13#section-3.1.3.1)

This suggests the token request also omits resource.

Workaround

Partial only:

• Manually patch the browser authorization URL to include resource=https://shared.marketingcloudmcp.com/mcp.

This gets past authorization, but the CLI still fails during token exchange.

Additional Notes

• codex mcp list showed marketingcloud-mcp auth as Unsupported in my environment, even though codex mcp login attempted OAuth.
• OAuth authorization server metadata is available at:
• https://app.marketingcloudmcp.com/.well-known/oauth-authorization-server

Possible Cause / Suggested Fix (Hypothesis)

It looks like codex mcp login may not currently support OAuth providers that require a resource parameter (resource indicator).

One possible fix:

• Support an MCP OAuth resource value per server config (or infer it when available), and
• Include the same resource in both:
• authorization request
• token request

Additional information

_No response_