OAuth authorization endpoint origin does not match the autho

Error message

OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

What it means

Error "OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks" thrown in openai/codex.

Source

Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:62

                (
                    issuer.as_str(),
                    authorization_endpoint.origin().ascii_serialization().as_str(),
                    token_endpoint.origin().ascii_serialization().as_str(),
                ),
                (
                    "https://api.figma.com/",
                    "https://www.figma.com",
                    "https://api.figma.com",
                ) | (
                    "https://agent.robinhood.com/mcp/trading",
                    "https://robinhood.com",
                    "https://api.robinhood.com",
                )
            )
        {
            return Ok(());
        }
        bail!(
            "OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks"
        );
    }

    if token_endpoint.origin() != authorization_endpoint.origin() {
        bail!(
            "OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks"
        );
    }

    Ok(())
}

/// Verifies that a stored refresh token remains bound to its original issuer.
///
/// Call this with the same metadata snapshot that RMCP will use for the credentials. Missing or
/// changed issuers require a new login rather than risking sending a refresh token to a different
/// authorization server.

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:62 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/31f039cf3e20d7e1. Report an issue: GitHub.