oauth_resource causes duplicate resource parameters in MCP OAuth authorization request

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.611.62324

What subscription do you have?

ChatGPT Business (organization-managed account)

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Summary

I'm trying to connect a Streamable HTTP MCP server that requires OAuth authentication from the Codex app.

During the OAuth flow, the MCP client needs to send a request to the IdP's /authorize endpoint. This request includes a resource parameter.

For our IdP (Microsoft Entra ID), the required value of resource is not the MCP server URL. Instead, it must be a value in the format:

api://<client-id>

Codex provides an oauth_resource configuration option for MCP servers, so I assume this is the intended way to specify a custom resource value.

Actual Behavior

When oauth_resource is configured, the authorization request generated by Codex contains the resource parameter twice.

For example:

https://login.microsoftonline.com/.../oauth2/v2.0/authorize
  ?client_id=...
  &response_type=code
  &redirect_uri=...
  &scope=...
  &resource=https://mcp.example.com
  &resource=api://<client-id>

It appears that Codex:

1. Automatically derives a resource value from the MCP server URL, and
2. Adds the value specified in oauth_resource

As a result, the request contains duplicate resource parameters, and Microsoft Entra ID rejects the request.

What steps can reproduce the bug?

1. Configure a Streamable HTTP MCP server that uses OAuth authentication with Microsoft Entra ID.
2. Set oauth_resource in the MCP server configuration to a value such as:

api://<client-id>

1. Start the OAuth login flow from the Codex app.
2. Inspect the request sent to the IdP's /authorize endpoint.
3. Observe that the authorization request contains two resource parameters:

• One derived from the MCP server URL.
• One from the configured oauth_resource value.

1. Observe that Microsoft Entra ID rejects the authorization request because of the duplicate resource parameters.

What is the expected behavior?

When oauth_resource is specified, Codex should use that value as the sole resource parameter and should not automatically add a second value derived from the MCP server URL.

Expected request:

&resource=api://<client-id>

Additional information

I found previous discussions related to support for the OAuth resource parameter (RFC 8707), and oauth_resource appears to have been introduced for this purpose.

However, the issue I'm seeing is not that resource cannot be specified, but that specifying oauth_resource results in duplicate resource parameters being included in the authorization request.