Summary
Authorizing the hosted Plan connector from Codex CLI fails at the callback step. Codex rejects the authorization response because it carries no iss parameter, which RFC 9207 requires when the authorization server's metadata advertises issuer identification.
$ codex mcp add plan --url https://plan.agent-native.com/mcp
Detected OAuth support. Starting OAuth flow…
Authorize `plan` by opening this URL in your browser:
https://plan.agent-native.com/mcp/oauth/authorize?response_type=code&client_id=agent-native-oauth-client-<uuid>&state=<state>&code_challenge=<challenge>&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A60126%2Fcallback%2F<token>&scope=mcp%3Aread+mcp%3Awrite+mcp%3Aapps+offline_access&resource=https%3A%2F%2Fplan.agent-native.com%2Fmcp
Error: failed to handle OAuth callback
Caused by:
Authorization server response missing required issuer: expected https://plan.agent-native.com
Reproduced identically with codex mcp login plan. The server entry is written to ~/.codex/config.toml, but no token is stored — codex mcp get plan shows the server enabled and codex mcp list reports Not logged in.
What this is not
Discovery metadata is correct, so this is not a metadata or issuer-mismatch problem. All three well-known endpoints return 200 with an issuer that matches the expected value exactly:
GET https://plan.agent-native.com/.well-known/oauth-authorization-server -> 200
GET https://plan.agent-native.com/.well-known/oauth-authorization-server/mcp -> 200
GET https://plan.agent-native.com/.well-known/oauth-protected-resource/mcp -> 200
{"issuer":"https://plan.agent-native.com","authorization_endpoint":"https://plan.agent-native.com/mcp/oauth/authorize","token_endpoint":"https://plan.agent-native.com/mcp/oauth/token","registration_endpoint":"https://plan.agent-native.com/mcp/oauth/register","response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token"],"code_challenge_methods_supported":["S256"]}It is also distinct from #2532. That issue is the client-ID-metadata-document flow rejecting a loopback redirect_uri with a port, and it fails earlier with 400 invalid_client. Codex uses dynamic client registration (client_id=agent-native-oauth-client-<uuid> via /mcp/oauth/register), so it gets past that point — a GET on the authorize URL above returns 200 text/html (the login page renders), not invalid_client. The failure here is strictly at callback handling.
Likely cause
The redirect back to http://127.0.0.1:<port>/callback/<token> appears to omit the iss query parameter. Codex validates it and aborts. Flagging this as the probable cause rather than a confirmed one — I did not capture the redirect itself, since doing so requires completing an interactive sign-in.
If that is right, the fix is to append iss=https://plan.agent-native.com to the authorization response redirect, alongside code and state.
Environment
codex-cli 0.144.5, macOS 26.5.1 (Apple Silicon)- Server:
https://plan.agent-native.com/mcp (hosted)
- Skills
visual-plan / visual-recap from BuilderIO/skills at dbadb9bd784ebc12b5705e69bc77bce1400fd3cd, installed as plain skill folders under ~/.codex/skills/
Impact
/visual-plan and /visual-recap cannot be used from Codex at all. Both skills are documented to publish only through the Plan MCP connector and to stop rather than fall back to inline output, so with the connector unauthorized there is no working path short of local-files mode.
Summary
Authorizing the hosted Plan connector from Codex CLI fails at the callback step. Codex rejects the authorization response because it carries no
issparameter, which RFC 9207 requires when the authorization server's metadata advertises issuer identification.Reproduced identically with
codex mcp login plan. The server entry is written to~/.codex/config.toml, but no token is stored —codex mcp get planshows the serverenabledandcodex mcp listreportsNot logged in.What this is not
Discovery metadata is correct, so this is not a metadata or issuer-mismatch problem. All three well-known endpoints return
200with anissuerthat matches the expected value exactly:{"issuer":"https://plan.agent-native.com","authorization_endpoint":"https://plan.agent-native.com/mcp/oauth/authorize","token_endpoint":"https://plan.agent-native.com/mcp/oauth/token","registration_endpoint":"https://plan.agent-native.com/mcp/oauth/register","response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token"],"code_challenge_methods_supported":["S256"]}It is also distinct from #2532. That issue is the client-ID-metadata-document flow rejecting a loopback
redirect_uriwith a port, and it fails earlier with400 invalid_client. Codex uses dynamic client registration (client_id=agent-native-oauth-client-<uuid>via/mcp/oauth/register), so it gets past that point — aGETon the authorize URL above returns200 text/html(the login page renders), notinvalid_client. The failure here is strictly at callback handling.Likely cause
The redirect back to
http://127.0.0.1:<port>/callback/<token>appears to omit theissquery parameter. Codex validates it and aborts. Flagging this as the probable cause rather than a confirmed one — I did not capture the redirect itself, since doing so requires completing an interactive sign-in.If that is right, the fix is to append
iss=https://plan.agent-native.comto the authorization response redirect, alongsidecodeandstate.Environment
codex-cli 0.144.5, macOS 26.5.1 (Apple Silicon)https://plan.agent-native.com/mcp(hosted)visual-plan/visual-recapfrom BuilderIO/skills atdbadb9bd784ebc12b5705e69bc77bce1400fd3cd, installed as plain skill folders under~/.codex/skills/Impact
/visual-planand/visual-recapcannot be used from Codex at all. Both skills are documented to publish only through the Plan MCP connector and to stop rather than fall back to inline output, so with the connector unauthorized there is no working path short of local-files mode.