Bring MCP OAuth callback pages in line with the existing Codex login UX

Open 💬 1 comment Opened Aug 4, 2026 by mbgit2

What variant of Codex are you using?

Codex App, IDE extension, and CLI flows that authenticate remote MCP servers through codex-rmcp-client.

What feature would you like to see?

The local MCP OAuth callback currently renders browser-default plain text. On success it shows:

Authentication complete. You may close this window.

Provider errors and invalid callbacks are similarly returned as unstyled text. This feels inconsistent with the regular ChatGPT login callback, which already has branded, theme-aware success and error pages.

Please bring the MCP OAuth callback pages into parity with the existing Codex login UX:

Render self-contained HTML for success, provider-error, and invalid-callback states.
Support light and dark color schemes and narrow/mobile browser windows.
Give common provider failures such as access_denied and invalid_scope clear user-facing copy.
Keep raw provider error details available in a secondary/collapsible section.
HTML-escape all provider-supplied values.
Return appropriate content type, no-cache, referrer, MIME-sniffing, and CSP headers.
Include snapshot coverage for the user-visible states.

The relevant callback responses are currently produced in:

codex-rs/rmcp-client/src/perform_oauth_login.rs

There is strong existing precedent in the main login flow:

#20136 updated the localhost login success page to match the Codex desktop auth UX.
#12289 replaced generic/plain login failures with a branded, actionable error page.

Additional information

This request is presentation-only and should not change OAuth discovery, requested scopes, callback validation, or token exchange behavior.

The underlying invalid_scope behavior is tracked separately in #23242. Issue #33151 also shows the exact current success text, but tracks a post-callback 403 rather than the callback page appearance.

A focused implementation can remain inside codex-rmcp-client: embed a static template, render the three callback states, add response security headers, and cover the rendered HTML with snapshots.

View original on GitHub ↗

1 Comment

TwumJnr · 18 days ago

I reproduced this in the Codex App on macOS after successfully authenticating a remote MCP server. The callback still displayed only Authentication complete. You may close this window., matching the issue description.

This is especially noticeable during GUI-only onboarding because the callback appears disconnected from the Codex experience and gives no clear route back to the app.

I’d be interested in contributing a focused implementation in codex-rmcp-client, following the existing branded login patterns from #20136 and #12289. I would keep the change presentation-only and include coverage for the success, provider-error, and invalid-callback states. If this approach aligns with the intended direction, would the team be willing to invite a PR?