MCP OAuth callback URL override is not used as an exact redirect URI

What issue are you seeing?

mcp_oauth_callback_url is documented and configurable as an optional redirect URI override for MCP OAuth login, but Codex still appends a server-derived callback id to the configured URL before sending it as redirect_uri.

For example, with config overrides equivalent to:

mcp_oauth_callback_port = 10230
mcp_oauth_callback_url = "http://localhost:10230/callback"

Codex builds an authorization URL whose redirect_uri is effectively:

http://localhost:10230/callback/<callback_id>

This breaks OAuth providers that require exact redirect URI matching, such as enterprise OIDC/Keycloak clients registered with a fixed localhost callback URL. The provider rejects the request before the authorization-code exchange with an error like:

invalid_request: The requested redirect_uri is missing in the client configuration.

The configured callback URL is valid for the provider, but the mutated URL with the extra path segment is not.

What steps can reproduce the bug?

1. Configure a streamable HTTP MCP server that uses OAuth with an OIDC provider whose client has only this redirect URI registered:

http://localhost:10230/callback

1. Run MCP login with explicit callback settings:

codex mcp login <server> \
  -c mcp_oauth_callback_port=10230 \
  -c 'mcp_oauth_callback_url="http://localhost:10230/callback"'

1. Inspect or open the authorization URL emitted by Codex.

Actual result: the redirect_uri includes an additional server-derived path segment after /callback, so strict OIDC clients reject it.

A small branch that demonstrates the proposed behavior is available here:

https://github.com/sshishigin/codex/tree/codex-respect-mcp-oauth-callback-url

Commit:

3560426d05 Respect configured MCP OAuth callback URL

What is the expected behavior?

When mcp_oauth_callback_url is explicitly configured, Codex should use it exactly as the OAuth redirect_uri.

The existing callback-id behavior can remain for generated local redirect URIs, where Codex chooses the listener address and callback path itself. The surprising part is mutating an explicit redirect URI override.

Additional information

This appears to be in codex-rs/rmcp-client/src/perform_oauth_login.rs: resolve_redirect_uri(...) returns the configured callback URL, and then append_callback_id_to_redirect_uri(...) is applied unconditionally.

Suggested high-level fix:

• if callback_url / mcp_oauth_callback_url is set, use it as-is;
• otherwise keep appending the server-derived callback id to generated local callback URLs.

Local validation of the proposed patch:

cargo fmt -p codex-rmcp-client
cargo test -p codex-rmcp-client callback

Environment used while diagnosing:

Codex CLI: codex-cli 0.0.0 local build
Platform: Darwin 25.5.0 arm64 arm
Terminal: Apple Terminal

I read docs/contributing.md and understand unsolicited PRs are not accepted. I am opening this issue first with root-cause analysis and a high-level fix outline; the branch is provided only as a concrete reference if maintainers want it.