openai/codex · error · anyhow::Error

MCP OAuth CIMD requires an ephemeral loopback callback at `/

Error message

MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/{callback_id}`

What it means

Error "MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/{callback_id}`" thrown in openai/codex.

Source

Thrown at codex-rs/rmcp-client/src/oauth_client_registration.rs:84

        && parsed_redirect_uri.query().is_none()
        && parsed_redirect_uri.fragment().is_none()
        && parsed_redirect_uri.username().is_empty()
        && parsed_redirect_uri.password().is_none();
    // MCP 2026-07-28 priority: pre-registered clients never reach this path; offer
    // advertised CIMD here and otherwise let rmcp fall back to DCR.
    // https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration
    let offer_cimd = match client_registration {
        McpOAuthClientRegistration::Auto => {
            cimd_advertised && native_redirect_supported && public_client_auth_supported
        }
        McpOAuthClientRegistration::Cimd => {
            if !cimd_advertised || !public_client_auth_supported {
                bail!(
                    "MCP authorization server does not advertise CIMD with token endpoint auth method `none`"
                );
            }
            if !native_redirect_supported {
                bail!(
                    "MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/{callback_id}`"
                );
            }
            true
        }
        McpOAuthClientRegistration::Dcr => false,
    };

    auth_manager.set_metadata(metadata);
    let mut request = AuthorizationRequest::new(redirect_uri)
        .with_scopes(scopes.iter().copied())
        .with_client_name("Codex");
    if offer_cimd {
        // CIMD is an active IETF Internet-Draft: this HTTPS client identifier resolves
        // to its self-referential JSON metadata document.
        // https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/
        request = request.with_client_metadata_url(format!(
            "https://chatgpt.com/oauth/codex/{callback_id}/client.json"

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/rmcp-client/src/oauth_client_registration.rs:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/bf7084e63392d627. Report an issue: GitHub.