OAuth issuer-bound callbacks require an authorization server

Error message

OAuth issuer-bound callbacks require an authorization server issuer

What it means

Error "OAuth issuer-bound callbacks require an authorization server issuer" thrown in openai/codex.

Source

Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:31

) -> Result<()> {
    let authorization_endpoint = Url::parse(&metadata.authorization_endpoint)
        .context("OAuth authorization endpoint must be a valid URL")?;
    let issuer = metadata
        .issuer
        .as_deref()
        .filter(|issuer| !issuer.trim().is_empty())
        .map(Url::parse)
        .transpose()
        .context("OAuth authorization server issuer must be a valid URL")?;
    let issuer_bound_callbacks = metadata
        .additional_fields
        .get("authorization_response_iss_parameter_supported")
        .and_then(serde_json::Value::as_bool)
        .unwrap_or(false);

    if issuer_bound_callbacks {
        if issuer.is_none() {
            bail!("OAuth issuer-bound callbacks require an authorization server issuer");
        }
        return Ok(());
    }

    let token_endpoint =
        Url::parse(&metadata.token_endpoint).context("OAuth token endpoint must be a valid URL")?;

    if let Some(issuer) = issuer {
        if authorization_endpoint.origin() == issuer.origin()
            || authorization_endpoint.origin() == token_endpoint.origin()
            // Remove these narrow compatibility exceptions once both providers support RFC 9207.
            || matches!(
                (
                    issuer.as_str(),
                    authorization_endpoint.origin().ascii_serialization().as_str(),
                    token_endpoint.origin().ascii_serialization().as_str(),
                ),
                (

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:31 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/117a7355927a408e. Report an issue: GitHub.