{"record":{"id":"dca0ca500f5b2ea9","repo":"openai/codex","slug":"oauth-token-endpoint-origin-does-not-match-the-aut","errorCode":null,"errorMessage":"OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks","messagePattern":"OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/rmcp-client/src/oauth/issuer_binding.rs","lineNumber":68,"sourceCode":"                    \"https://api.figma.com/\",\n                    \"https://www.figma.com\",\n                    \"https://api.figma.com\",\n                ) | (\n                    \"https://agent.robinhood.com/mcp/trading\",\n                    \"https://robinhood.com\",\n                    \"https://api.robinhood.com\",\n                )\n            )\n        {\n            return Ok(());\n        }\n        bail!(\n            \"OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks\"\n        );\n    }\n\n    if token_endpoint.origin() != authorization_endpoint.origin() {\n        bail!(\n            \"OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks\"\n        );\n    }\n\n    Ok(())\n}\n\n/// Verifies that a stored refresh token remains bound to its original issuer.\n///\n/// Call this with the same metadata snapshot that RMCP will use for the credentials. Missing or\n/// changed issuers require a new login rather than risking sending a refresh token to a different\n/// authorization server.\npub(crate) fn validate_refresh_token_issuer(\n    metadata: &AuthorizationMetadata,\n    tokens: &StoredOAuthTokens,\n) -> Result<()> {\n    if !tokens.has_refresh_token() {\n        return Ok(());","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/rmcp-client/src/oauth/issuer_binding.rs#L50-L86","documentation":"Error \"OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:68 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}