openai/codex · error · OAuthHttpClientAdapterError

OAuth authorization server issuer does not match authorizati

Error message

OAuth authorization server issuer does not match authorization metadata origin

What it means

Error "OAuth authorization server issuer does not match authorization metadata origin" thrown in openai/codex.

Source

Thrown at codex-rs/rmcp-client/src/oauth_http_client.rs:51

use crate::auth_status::OAuthDiscoveryTimeout;
use crate::http_client_adapter::StreamableHttpRedirectMode;
use crate::utils::MCP_USER_AGENT;

const MAX_OAUTH_HTTP_RESPONSE_BODY_BYTES: usize = 1024 * 1024;
const MAX_OAUTH_HTTP_REDIRECTS: usize = 10;
static NEXT_OAUTH_REQUEST_ID: AtomicU64 = AtomicU64::new(0);

#[derive(Debug, thiserror::Error)]
enum OAuthHttpClientAdapterError {
    #[error("unsupported OAuth HTTP redirect policy")]
    UnsupportedRedirectPolicy,
    #[error("OAuth HTTP request timed out")]
    TimedOut,
    #[error("OAuth HTTP request exceeded {MAX_OAUTH_HTTP_REDIRECTS} redirects")]
    TooManyRedirects,
    #[error("OAuth HTTP response body exceeds {maximum_bytes} bytes")]
    ResponseBodyTooLarge { maximum_bytes: usize },
    #[error("OAuth authorization server issuer does not match authorization metadata origin")]
    AuthorizationMetadataIssuerOriginMismatch,
}

fn oauth_http_client_error(
    error: impl std::error::Error + Send + Sync + 'static,
) -> OAuthHttpClientError {
    Box::new(error)
}

#[derive(Clone)]
pub(crate) struct OAuthHttpClientAdapter {
    http_client: Arc<dyn HttpClient>,
    default_headers: HeaderMap,
    resource_origin: Origin,
    timeout: OAuthDiscoveryTimeout,
    has_configured_headers: bool,
    redirect_mode: StreamableHttpRedirectMode,
}

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/rmcp-client/src/oauth_http_client.rs:51 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/991f15fd15aadb99. Report an issue: GitHub.