codex - 💡(How to fix) Fix Codex does not auto-refresh routed MCP OAuth tokens even when a refresh token is stored [1 comments, 2 participants]

{"success": false, "error": "invalid_grant", "msg": "Authorization required"}

TL;DR

Implement automatic refresh token logic to obtain a new access token when the existing one expires, using the stored refresh_token in ~/.codex/.credentials.json.

Guidance

• Review the authentication flow in Codex to identify where the refresh token logic should be implemented to automatically obtain a new access token when the existing one expires.
• Verify that the refresh_token stored in ~/.codex/.credentials.json is valid and not expired, and that it is being used correctly in the authentication flow.
• Consider implementing a periodic check for access token expiration, and use the refresh_token to obtain a new access token before it is needed for MCP calls.
• Investigate the error handling for the invalid_grant error, to ensure that it is properly handled and that the refresh token logic is triggered when necessary.

Example

No specific code example can be provided without more information about the Codex authentication implementation, but a general example of refresh token usage might involve sending a request to the token endpoint with the refresh_token and other required parameters, such as client ID and client secret.

Notes

The implementation details of the refresh token logic may vary depending on the specific requirements and constraints of the Codex application and the MCP server. It is also important to ensure that the refresh token is properly validated and handled to prevent security vulnerabilities.

Recommendation

Apply a workaround by implementing automatic refresh token logic, as this will allow Codex to continue making authenticated MCP calls without requiring manual CLI login, which is especially important for automations and recurring background runs.