Home/Wiki Errors/OpenAI Codex
OpenAI Codex / MCP OAuth

MCP auth session does not refresh - Codex OAuth

The browser OAuth flow succeeded, but Codex continued using a stale or invalid MCP token for the routed server.

Codex MCP OAuth token not refreshingCodex browser login successful MCP unauthorizedCodex routed MCP OAuth tokens
Paste an error to match it against the wiki. / 粘贴报错后自动匹配。

Error text / 报错原文

  • MCP auth/session does not refresh
  • browser login successful but MCP still unauthorized
  • routed MCP OAuth tokens

What it means

The browser OAuth flow succeeded, but Codex continued using a stale or invalid MCP token for the routed server.

Most common causes

  • Refresh token stored but not reloaded by the active session
  • Multiple MCP routes share confusing auth state
  • The server returns a misleading provider-specific auth error
  • Desktop session needs a restart after OAuth

Fastest fix

  • Restart the Codex session after browser OAuth
  • Disconnect and reconnect only the affected MCP server
  • Verify the MCP server URL and route name
  • Try a new thread to force fresh server discovery

Safe fix

  • Keep MCP server names stable
  • Use least-privilege OAuth scopes
  • Document token lifetime and refresh behavior for each server
  • Avoid mixing personal and enterprise accounts in the same server entry

What not to do

  • Do not paste refresh tokens into mcp.json
  • Do not delete all Codex state before exporting needed logs
  • Do not assume a GitHub-looking error means GitHub is the failing provider

How to confirm the fix

Run the smallest reproducible command first, then retry the agent task only after authentication, quota, and tool discovery are stable.

codex mcp list
codex --version
Get-ChildItem $env:USERPROFILE\.codex -Force

Related errors

Related tools

Sources