›_ Codex Issues
Codex Issues / #8835

Unable to authenticate with MCP server when running in remote environment

Open 💬 4 comments Opened Jan 7, 2026 by WhammyLeaf
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

0.79.0

What subscription do you have?

Own API key

Which model were you using?

gpt-5.1

What platform is your computer?

Linux 5.15.0-305.176.4.el8uek.x86_64 x86_64 x86_64

What issue are you seeing?

We are running the codex CLI tool in a remote codeserver/WebIDE environment. It is impossible to access OAuth protected MCP servers in this environment due to Codex using localhost as callback URI: the localhost will point to the machine that the user is on, not the machine that codex is running on.

What steps can reproduce the bug?

  1. Setup a codeserver/WebIDE environment.
  2. Define config for an OAuth protected MCP server in config.toml
  3. try to authenticate with codex mcp login [NAME]
  4. new tab opens in browser window
  5. but OH NO: "This site can’t be reached"

What is the expected behavior?

New tab in browser should indicate successful authentication and when going back to codeserver tab, the MCP server authentication process in the terminal should be completed.

Additional information

_No response_

View original on GitHub ↗

4 Comments

github-actions[bot] contributor · 7 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #8827
  • #8576
  • #6766

Powered by Codex Action

janEbert · 3 months ago

I guess a similar solution as what was used to support https://github.com/openai/codex/issues/2798 could be applied here. This would also be very useful for running in other headless environments, such as containers.

WhammyLeaf contributor · 3 months ago

@janEbert @eric-oai What exactly is the solution? Actually, the current functionality almost supports authenticating with oauth protected mcp servers in a webide. There is just one technicality which needs to be handled. I explain it here: https://github.com/openai/codex/issues/24058

janEbert · 3 months ago

Hey, quoting from the linked issue, because it summarizes the solution well:

### Add “Hosted Redirect + Copy-Paste Code” Flow (PKCE) - CLI launches OAuth with PKCE and redirect_uri pointing to an OpenAI-hosted page (e.g., https://console.openai.com/cli/callback). - After the user signs in (in any browser), the hosted page displays a short one-time code (e.g., ABCD-EFGH-IJKL) tied to the CLI session via state. - The CLI prompts: Paste the authentication code: and exchanges it (with code_verifier) for tokens. - The CLI never depends on a local HTTP server.

As another option, Claude Code, for example, also redirects to a local server, but you can just paste the redirect URL into Claude Code to finish authentication. So even if you can't reach the local exchange server the URL points to, as long as you got correctly redirected to the URL (again, from an external auth provider), you can still authenticate.