OAuth token endpoint origin does not match the authorization

Error message

OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks

What it means

Error "OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks" thrown in openai/codex.

Source

Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:68

                    "https://api.figma.com/",
                    "https://www.figma.com",
                    "https://api.figma.com",
                ) | (
                    "https://agent.robinhood.com/mcp/trading",
                    "https://robinhood.com",
                    "https://api.robinhood.com",
                )
            )
        {
            return Ok(());
        }
        bail!(
            "OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks"
        );
    }

    if token_endpoint.origin() != authorization_endpoint.origin() {
        bail!(
            "OAuth token endpoint origin does not match the authorization server origin without issuer-bound callbacks"
        );
    }

    Ok(())
}

/// Verifies that a stored refresh token remains bound to its original issuer.
///
/// Call this with the same metadata snapshot that RMCP will use for the credentials. Missing or
/// changed issuers require a new login rather than risking sending a refresh token to a different
/// authorization server.
pub(crate) fn validate_refresh_token_issuer(
    metadata: &AuthorizationMetadata,
    tokens: &StoredOAuthTokens,
) -> Result<()> {
    if !tokens.has_refresh_token() {
        return Ok(());

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/rmcp-client/src/oauth/issuer_binding.rs:68 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/dca0ca500f5b2ea9. Report an issue: GitHub.