codex - 💡(How to fix) Fix codex mcp login: missing 'resource' parameter in OAuth authorize request

Bug Description

codex mcp login <server> correctly discovers the OAuth protected resource metadata via /.well-known/oauth-protected-resource, but when constructing the authorization URL, it does not include the resource parameter. This causes the authorization server to issue a token with aud set to the client_id instead of the resource URL, which the resource server then rejects.

Steps to Reproduce

1. Configure a remote MCP server with OAuth:

   codex mcp add my-server --url "https://my-resource-server.example.com/mcp"

2. The resource server correctly implements MCP auth spec:

   • GET /.well-known/oauth-protected-resource returns:

     {
       "resource": "https://my-resource-server.example.com",
       "authorization_servers": ["https://my-auth-server.example.com"],
       "bearer_methods_supported": ["header"]
     }

   • Unauthenticated requests return 401 with:

     WWW-Authenticate: Bearer resource_metadata="https://my-resource-server.example.com/.well-known/oauth-protected-resource"

3. Run codex mcp login my-server — the browser opens with:

   https://my-auth-server.example.com/authorize?response_type=code&client_id=codex_xxx&code_challenge=xxx&code_challenge_method=S256&redirect_uri=http://127.0.0.1:PORT/callback

   Note: no resource parameter.

4. Login succeeds, but starting Codex fails:

   ⚠ MCP startup incomplete (failed: my-server)

Expected Behavior

Per RFC 9728 and the MCP Authorization Spec, the authorize URL should include:

&resource=https://my-resource-server.example.com

This ensures the authorization server issues a token with the correct audience (aud: ["https://my-resource-server.example.com"]), which the resource server can validate.

Actual Behavior

• The resource parameter is omitted from the authorize request
• The issued token has aud: ["codex_xxx"] (the client_id)
• The resource server rejects the token with 401 Unauthorized

Workaround

Manually perform the OAuth flow with the resource parameter and pass the token via --bearer-token-env-var:

codex mcp add my-server --url "https://my-resource-server.example.com/mcp" --bearer-token-env-var MY_TOKEN

Environment

• Codex CLI version: 0.130.0
• OS: macOS 14.x (also affects Linux)