{"record":{"id":"31f039cf3e20d7e1","repo":"openai/codex","slug":"oauth-authorization-endpoint-origin-does-not-match","errorCode":null,"errorMessage":"OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks","messagePattern":"OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/rmcp-client/src/oauth/issuer_binding.rs","lineNumber":62,"sourceCode":"                (\n                    issuer.as_str(),\n                    authorization_endpoint.origin().ascii_serialization().as_str(),\n                    token_endpoint.origin().ascii_serialization().as_str(),\n                ),\n                (\n                    \"https://api.figma.com/\",\n                    \"https://www.figma.com\",\n                    \"https://api.figma.com\",\n                ) | (\n                    \"https://agent.robinhood.com/mcp/trading\",\n                    \"https://robinhood.com\",\n                    \"https://api.robinhood.com\",\n                )\n            )\n        {\n            return Ok(());\n        }\n        bail!(\n            \"OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks\"\n        );\n    }\n\n    if token_endpoint.origin() != authorization_endpoint.origin() {\n        bail!(\n            \"OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks\"\n        );\n    }\n\n    Ok(())\n}\n\n/// Verifies that a stored refresh token remains bound to its original issuer.\n///\n/// Call this with the same metadata snapshot that RMCP will use for the credentials. Missing or\n/// changed issuers require a new login rather than risking sending a refresh token to a different\n/// authorization server.","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/rmcp-client/src/oauth/issuer_binding.rs#L44-L80","documentation":"Error \"OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:62 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}