VS Code extension: MCP OAuth completes in browser but connector callback returns 403

Summary

OAuth authorization for a remote MCP connector completes in the browser, but the Codex VS Code extension fails while finishing the connector callback.

After the browser reaches the local loopback callback and displays:

Authentication complete. You may close this window.

the VS Code extension shows:

Failed to finish connecting app.

The extension log shows that it handles /connector/oauth_callback, then receives HTTP 403 from the OpenAI endpoint /aip/connectors/links/oauth/callback.

Steps to reproduce

1. Configure a remote MCP server that uses OAuth.
2. Invoke an MCP tool while the connector is disconnected or its authorization has expired.
3. Click Reconnect in the Codex VS Code extension.
4. Complete login in the browser.
5. Approve the requested scopes on the OAuth consent screen.
6. The browser redirects to the extension's loopback callback on 127.0.0.1 and displays “Authentication complete. You may close this window.”
7. Return to VS Code.

Expected behavior

The connector finishes linking, becomes authenticated, and the requested MCP tool can run.

Actual behavior

VS Code displays “Failed to finish connecting app.” The connector remains expired/disconnected and MCP tool calls cannot proceed.

Extension logs

This reproduced multiple times on July 14 and July 15, 2026:

2026-07-15 05:41:15.790 [info] Handling URI path=/connector/oauth_callback
2026-07-15 05:41:17.290 [error] Error fetching httpStatus=403 requestId=a1b358e1ddabeb95-NRT statusText=Forbidden url=/aip/connectors/links/oauth/callback
2026-07-15 05:41:17.291 [warning] sa_server_request_failed attachAuth=false attachIntegrityState=false error={} hasRequestBody=true method=post requestHeaderNames=["OAI-Language"] routePattern=/aip/connectors/links/oauth/callback status=403 url=/aip/connectors/links/oauth/callback
2026-07-15 05:41:17.292 [error] Failed to finish app OAuth callback error={}

Other request IDs from the same reproducible failure:

a1a92d29fd54fd46-NRT
a1a92d825a3bd5b5-NRT
a1a92fa26b8176bd-NRT
a1b32769b8af11f6-NRT

No OAuth authorization code, state value, access token, or refresh token is included here.

Environment

• VS Code: 1.127.0 (arm64)
• OpenAI Codex VS Code extension: 26.707.71524
• Codex CLI: 0.144.1
• macOS: 26.5.2 (25F84), Apple Silicon
• Remote MCP transport: HTTPS
• OAuth flow: Authorization Code with PKCE and a loopback redirect URI

Additional observations

• The failure occurs after the browser has successfully reached the local loopback callback.
• The 403 is logged by the VS Code extension for the OpenAI-side callback endpoint, not by a shell command or a local sandboxed process.
• A direct MCP connection using codex mcp login can authenticate separately, but it does not fix the connector managed by the VS Code extension.
• I could not find an existing issue that contains either the exact toast text or the exact endpoint above.

Possibly related, but not exact duplicates:

• #16341
• #19070
• #21346