{"record":{"id":"117a7355927a408e","repo":"openai/codex","slug":"oauth-issuer-bound-callbacks-require-an-authorizat","errorCode":null,"errorMessage":"OAuth issuer-bound callbacks require an authorization server issuer","messagePattern":"OAuth issuer-bound callbacks require an authorization server issuer","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/rmcp-client/src/oauth/issuer_binding.rs","lineNumber":31,"sourceCode":") -> Result<()> {\n    let authorization_endpoint = Url::parse(&metadata.authorization_endpoint)\n        .context(\"OAuth authorization endpoint must be a valid URL\")?;\n    let issuer = metadata\n        .issuer\n        .as_deref()\n        .filter(|issuer| !issuer.trim().is_empty())\n        .map(Url::parse)\n        .transpose()\n        .context(\"OAuth authorization server issuer must be a valid URL\")?;\n    let issuer_bound_callbacks = metadata\n        .additional_fields\n        .get(\"authorization_response_iss_parameter_supported\")\n        .and_then(serde_json::Value::as_bool)\n        .unwrap_or(false);\n\n    if issuer_bound_callbacks {\n        if issuer.is_none() {\n            bail!(\"OAuth issuer-bound callbacks require an authorization server issuer\");\n        }\n        return Ok(());\n    }\n\n    let token_endpoint =\n        Url::parse(&metadata.token_endpoint).context(\"OAuth token endpoint must be a valid URL\")?;\n\n    if let Some(issuer) = issuer {\n        if authorization_endpoint.origin() == issuer.origin()\n            || authorization_endpoint.origin() == token_endpoint.origin()\n            // Remove these narrow compatibility exceptions once both providers support RFC 9207.\n            || matches!(\n                (\n                    issuer.as_str(),\n                    authorization_endpoint.origin().ascii_serialization().as_str(),\n                    token_endpoint.origin().ascii_serialization().as_str(),\n                ),\n                (","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/rmcp-client/src/oauth/issuer_binding.rs#L13-L49","documentation":"Error \"OAuth issuer-bound callbacks require an authorization server issuer\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:31 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}