Codex CLI hangs during MCP OAuth login when credential store is auto/keyring on Linux

Summary

Codex CLI can hang during MCP OAuth login for remote OAuth MCP servers when MCP OAuth credential storage is left at the default auto mode on Linux. The browser OAuth flow reaches the completion page, but the CLI does not complete the login or persist MCP OAuth credentials. Forcing MCP OAuth credentials to file storage works around the issue.

Environment

• Codex CLI: 0.143.0
• Install method: global npm package @openai/codex
• OS: Linux
• Node: v22.22.0
• Affected MCP servers tested:
• https://mcp.figma.com/mcp
• https://mcp.notion.com/mcp
• https://mcp.cloudflare.com/mcp

Symptoms

1. Run MCP OAuth login, for example:

``bash
codex mcp login figma --scopes mcp:connect
``

1. Codex prints an authorization URL and opens/uses the browser flow.
2. Browser reaches the page saying authentication is complete and the window may be closed.
3. The terminal does not complete the login, and no usable MCP OAuth credentials appear to be persisted.

A related startup symptom was also observed: enabling one unauthenticated OAuth MCP server, such as Figma, Notion, or Cloudflare, caused codex exec --json to hang before emitting thread.started. Disabling those MCP servers allowed the same codex exec command to complete normally.

Expected behavior

• If mcp_oauth_credentials_store = "auto" selects a keyring backend and that backend fails or is unavailable, Codex should either fall back cleanly to file storage or emit a clear terminal error and exit.
• Enabling an unauthenticated OAuth MCP server should not silently hang Codex startup.

Workaround

Adding these top-level settings to ~/.codex/config.toml allowed MCP OAuth login to complete successfully:

mcp_oauth_credentials_store = "file"
mcp_oauth_callback_port = 4321

mcp_oauth_credentials_store = "file" appears to be the important part. The fixed callback port mainly made the flow easier to debug and verify.

Additional notes

• The issue is not caused by the remote MCP URLs being unreachable; the OAuth browser flow reaches the completion page.
• Supplying a bearer_token_env_var also avoids the silent hang path: invalid or missing bearer tokens produce errors or allow Codex to continue, rather than blocking startup.
• No secrets or auth files are attached.