mcp oauth (experimental) not working with supabase mcp

Resolved 💬 4 comments Opened Oct 16, 2025 by MauScheff Closed Oct 23, 2025

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

codex-cli 0.45.0

What subscription do you have?

API

Which model were you using?

gpt-5-codex

What platform is your computer?

Darwin 24.6.0 x86_64 i386

What issue are you seeing?

experimental_use_rmcp_client = true
[mcp_servers.supabase]
url = "https://mcp.supabase.com/mcp?project_ref=xxxxxxxxxx&read_only=true"

❯ codex mcp login supabase
Dynamic registration failed: Registration failed: HTTP 404 Not Found: 
Authorize `supabase` by opening this URL in your browser:
https://mcp.supabase.com/authorize?project_ref=xxxxxxxxx&read_only=true&response_type=code&client_id=mcp-client&state=tshk3Txx-eZzGANecv2EaJZDQ&code_challenge=xxxxxx&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A49387%2Fcallback

I open the link and says not found, supabase provides buttons for vscode that use the same link and it works.

What steps can reproduce the bug?

open a supabase account, create a poject, try to connect via mcp with codex.

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

4 Comments

github-actions[bot] contributor · 10 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#5045

Powered by Codex Action

MauScheff · 10 months ago

Not a duplicate, but related.

gpeal contributor · 10 months ago

It looks like supabase uses the following header for oauth discovery:

www-authenticate: Bearer error="invalid_request", error_description="No access token was provided in this request", resource_metadata="https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp"

which I'll need to add support for in https://github.com/modelcontextprotocol/rust-sdk. I'll leave this open until I can fix it there and get it merged here.

https://www.rfc-editor.org/rfc/rfc9728.html#name-use-of-www-authenticate-for

gpeal contributor · 10 months ago

Fixed by https://github.com/openai/codex/pull/5423