mcp_servers.{server_name} uses unsupported `bearer_token`; s

Error message

mcp_servers.{server_name} uses unsupported `bearer_token`; set `bearer_token_env_var`.

What it means

Error "mcp_servers.{server_name} uses unsupported `bearer_token`; set `bearer_token_env_var`." thrown in openai/codex.

Source

Thrown at codex-rs/core/src/config/mod.rs:2205

        .try_into()
        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))
}

/// We briefly allowed plain text bearer_token fields in MCP server configs.
/// We want to warn people who recently added these fields but can remove this after a few months.
fn ensure_no_inline_bearer_tokens(value: &TomlValue) -> std::io::Result<()> {
    let Some(servers_table) = value.as_table() else {
        return Ok(());
    };

    for (server_name, server_value) in servers_table {
        if let Some(server_table) = server_value.as_table()
            && server_table.contains_key("bearer_token")
        {
            let message = format!(
                "mcp_servers.{server_name} uses unsupported `bearer_token`; set `bearer_token_env_var`."
            );
            return Err(std::io::Error::new(ErrorKind::InvalidData, message));
        }
    }

    Ok(())
}

pub(crate) fn set_project_trust_level_inner(
    doc: &mut DocumentMut,
    project_path: &Path,
    trust_level: TrustLevel,
) -> anyhow::Result<()> {
    // Ensure we render a human-friendly structure:
    //
    // [projects]
    // [projects."/path/to/project"]
    // trust_level = "trusted" or "untrusted"
    //
    // rather than inline tables like:

View on GitHub (pinned to 339751715c)

Solutions

Replace `bearer_token` with `bearer_token_env_var` referencing an environment variable that holds the token.

When it happens

Trigger: Thrown at codex-rs/core/src/config/mod.rs:2205 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/a2489e1be4a30084. Report an issue: GitHub.