MCP OAuth login reports missing issuer although `iss` is present in callback

Resolved 💬 2 comments Opened Jul 11, 2026 by ludixplore Closed Jul 11, 2026

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

ChatGPT Powered by Codex & OWL Version 26.707.31428 Released 10 jul 2026 (codex-cli 0.144.1)

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What issue are you seeing?

Summary

OAuth authentication for the official Magnific MCP server fails in Codex CLI
0.144.1 on Windows.

Codex reports that the authorization response is missing the required issuer,
but the callback URL visibly contains the iss parameter with the exact
expected value.

Feedback ID:
019f5070-e26c-77d0-a7fe-255c2addc381

Environment

Operating system: Windows
Codex CLI: 0.144.1
Codex Desktop: installed
MCP transport: Streamable HTTP
MCP server: https://mcp.magnific.com
Authentication: OAuth

Configuration

[mcp_servers.magnific]
url = "https://mcp.magnific.com"
auth = "oauth"
enabled = true
default_tools_approval_mode = "prompt"

### What steps can reproduce the bug?

Feedback ID: 019f5070-e26c-77d0-a7fe-255c2addc381

### What is the expected behavior?

Codex should accept the matching iss value, exchange the authorization code,
store the OAuth credentials, and report the MCP server as logged in.

### Additional information

The same behavior is reproducible through Codex Desktop authentication and
through codex mcp login magnific.
Changing browsers and enabling or disabling two-factor authentication does not
change the result.
No manually supplied API key or bearer token is being used.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#31573

Powered by Codex Action

ludixplore · 1 month ago

Resolved as a duplicate of #31573.

The issue is a Codex CLI regression affecting OAuth issuer validation.

Environment:

Windows 10 x64
Codex CLI 0.144.1
Remote MCP server using OAuth Authorization Code flow

The callback URL contained the expected iss parameter, but Codex 0.144.1 incorrectly reported:

Authorization server response missing required issuer

As a temporary workaround, I completed the OAuth login using Codex CLI 0.141.0 without replacing my current global installation:

npx -y @openai/codex@0.141.0 mcp login magnific

The authentication completed successfully:

Successfully logged in to MCP server 'magnific'.

The credentials are then recognized by Codex CLI 0.144.1:

magnific https://mcp.magnific.com enabled OAuth

Feedback ID:
019f5070-e26c-77d0-a7fe-255c2addc381

Closing this issue in favor of #31573. Thanks.