Codex MCP Login Error: How to Fix Auth Unsupported

You run codex mcp list, the new server shows up, and the Auth column says Unsupported. Then codex mcp login either refuses to start or stops with a complaint about missing authorization support. The tools never appear in your session, and nothing in the output tells you which of several different problems you hit.

This page sorts them in the order you should check them. First, whether Unsupported is a problem at all, because for some servers it is the correct label. Then three fixes (a bearer token, a clean OAuth login, a stdio bridge), a macOS regression reported in July 2026, and a look-alike error that has nothing to do with login.

💡 Short answer: Unsupported means Codex found nothing to authenticate with. For a stdio server that is normal. For an HTTP server that needs credentials, give Codex a bearer token variable, re-run codex mcp login <name> on a current build, or route the server through mcp-remote.

What Auth Unsupported Means

Where the label comes from

Codex computes the Auth column itself. According to a walkthrough of the codex mcp subcommand, both list and get check three things for every server:

1. Is a bearer token environment variable configured, and is it actually set?
2. Are stored OAuth tokens sitting in the credential store?
3. Does the HTTP endpoint advertise OAuth metadata?

If none of the three applies, the column reads Unsupported. The label describes what Codex can see, not what the server needs. A server can demand a login and still show Unsupported when its metadata is missing, malformed, or unreachable from your machine.

Status values at a glance

The official examples show authenticated and unsupported. Wording for the logged-out state shifts between releases, so treat the column as a hint and confirm with /mcp inside the Codex TUI, which lists your active MCP servers. The official Codex MCP documentation has the full list of server settings.

For a clean paste into a ticket or a script, codex mcp list --json and codex mcp get my-server --json print the same status data in machine-readable form. That is also the quickest way to compare a machine where login works against one where it does not.

Stdio or HTTP: Check the Server Type

Before you change anything, find out which kind of server you registered. Open ~/.codex/config.toml and look at the entry. A command line means stdio. A url line means streamable HTTP. The fix depends entirely on that difference.

Stdio servers: Unsupported is normal

A stdio server is a local process that Codex starts and talks to through standard input and output:

[mcp_servers.local-tools]
command = "npx"
args = ["-y", "some-mcp-package"]
env = { LOG_LEVEL = "info" }

Copy Prompt

OAuth belongs to the HTTP transport. The reference says it plainly: "OAuth login is only supported for streamable HTTP servers." So codex mcp login local-tools is rejected by design, and Unsupported is the expected label. If that server needs a credential, hand it over through env or env_vars in the same table instead of trying to log in.

💡 A public server that needs no authentication will also read Unsupported. If the tools show up in your session, there is nothing to fix.

HTTP servers: Unsupported is a warning

An HTTP entry looks different:

[mcp_servers.my-server]
url = "https://mcp.example.com/mcp"

Copy Prompt

If this server expects credentials and the column still says Unsupported, one of three things is going on:

• The server uses static tokens, not OAuth, and you have not supplied one.
• The server uses OAuth, but Codex cannot reach or parse its metadata.
• Your Codex build is too old for the metadata lookup the server needs.

Each cause has a matching fix below.

Fix 1: Send a Bearer Token

If the provider hands you an API token from a dashboard, this is the shortest path. No browser, no callback, no metadata lookup.

Export the variable

Put the token in an environment variable, then register the server with the variable's name:

export MY_SERVER_TOKEN="paste-the-token-value-here"
codex mcp add my-server --url https://mcp.example.com/mcp --bearer-token-env-var MY_SERVER_TOKEN

Copy Prompt

The --bearer-token-env-var flag stores the variable name, and the token itself is never written to disk.

Point the config at it

The result in config.toml should read:

[mcp_servers.my-server]
url = "https://mcp.example.com/mcp"
bearer_token_env_var = "MY_SERVER_TOKEN"
startup_timeout_sec = 20

Copy Prompt

Four slip-ups account for most failures here:

• Pasting the token into bearer_token_env_var. That field takes the variable name, not the secret.
• Exporting in the wrong shell. A variable set in one terminal tab is invisible to another.
• Launching Codex from an editor or dock icon. Those processes often miss variables exported in your shell profile. Start Codex from the terminal that holds the variable, or set it system-wide.
• Storing the whole header line. Keep only the token value, since Codex sends it in the Authorization header for you.

Run codex mcp list again. The column should leave Unsupported as soon as the variable is set.

In CI, store the token as a masked secret and export it in the job step that launches Codex. The variable name in config.toml stays the same, so the file can live in the repository without leaking anything.

Fix 2: Run the OAuth Login

When the server expects OAuth, there is no token to paste. Codex has to walk through a browser sign-in and store the result.

Log in, log out, retry

codex mcp login my-server
codex mcp login my-server --scopes "read,write"
codex mcp logout my-server

Copy Prompt

The first command opens your browser. Approve the request and return to the terminal. The second asks for specific scopes when the server's defaults are too narrow. The third wipes stored credentials and prints either Removed OAuth credentials for 'my-server' or No OAuth credentials stored for 'my-server'.

Working over SSH or on a headless box is the usual trap. The sign-in page opens in a browser, and the provider then redirects to a callback address that must reach the machine running Codex. On a remote host that redirect often lands on your laptop instead, and the login never finishes. Forward the callback port, or pick Fix 1 or Fix 3 for that machine.

When a login keeps failing, log out first, then log in again, so you are not fighting a stale session. Do the same before deleting a server entry, because removing the entry does not revoke or delete tokens already stored.

Pin the resource and callback

Providers that follow the newer OAuth rules tie every token to one canonical resource URL. MintMCP's Codex notes recommend setting oauth_resource explicitly on the server entry rather than letting Codex derive it, and keeping the same URL across the MCP endpoint, the resource metadata, the authorization request, and the token audience:

[mcp_servers.my-server]
url = "https://mcp.example.com/mcp"
oauth_resource = "https://mcp.example.com/mcp"

[mcp_servers.my-server.oauth]
client_id = "your-preregistered-client-id"
callback_url = "http://localhost:8765/callback"

Copy Prompt

Add the oauth table only when the provider gave you a pre-registered client ID. The callback URL must match, character for character, what the provider has on file.

OAuth support landed in Codex piece by piece, so your version matters:

A server that works on the newest build can fail on a release two months older, because the lookup took a different path. Check with codex --version, then update through whichever installer you used, for example npm i -g @openai/codex@latest.

Fix 3: Put mcp-remote in the Middle

Sometimes the server is fine, your token is fine, and Codex still reports Unsupported. The cleanest escape is to stop asking Codex to do OAuth at all. The mcp-remote package is a small stdio proxy that talks to the remote server and runs the browser sign-in on its own, so Codex only ever sees a local process.

Wire the bridge

[mcp_servers.my-server]
command = "npx"
args = ["-y", "mcp-remote", "https://mcp.example.com/mcp"]
startup_timeout_sec = 60

Copy Prompt

Raise startup_timeout_sec above its default of 10 seconds. The first launch waits for you to finish the browser sign-in, and a short timeout kills the process before you can click anything. Remove any older entry with the same name first, so the two do not collide.

Trade-offs to accept

• The Auth column will keep saying Unsupported. That is expected: Codex now sees a stdio server, and the bridge handles authentication.
• You depend on Node and npx being available where Codex runs.
• Tokens live in the bridge's own cache (usually ~/.mcp-auth), not in Codex. If a bad login keeps replaying, clear that folder.
• You skip the Codex OAuth path, which means no Codex-managed re-authentication after a mid-session 401.

For a server you use daily, this is a reasonable permanent setup. For a one-off test, Fix 1 is quicker.

Still Failing After the Fix?

macOS: no authorization support detected

One failure deserves its own entry. MintMCP documents a case where codex mcp login stops with No authorization support detected on macOS, starting with releases from 2026-07-22. Against a spec-compliant OAuth server, the same Codex version logs in on Linux and fails the metadata step on macOS. It is tracked as openai/codex#34684.

Before you blame the server, test its metadata from the machine that fails:

curl -i https://mcp.example.com/.well-known/oauth-protected-resource

Copy Prompt

A JSON body means the server is publishing what the spec asks for, and the problem sits on the Codex side. Some servers append the endpoint path instead, such as /.well-known/oauth-protected-resource/mcp. Your options, in order of effort:

1. Update Codex and retry, since fixes ship often.
2. Use a bearer token (Fix 1) if the provider offers one.
3. Route through mcp-remote (Fix 3), which moves the OAuth flow out of Codex.

Connection closed on initialize

Some errors look like auth failures and are not. A report on GitHub issue #5619 describes Codex CLI v0.47.0 connecting to a streamable HTTP server with a bearer token and ending with connection closed: initialize response. The client announced protocol version 2025-06-18 yet behaved like the older 2024-11-05 transport: it closed the connection right after the endpoint event and never waited for the initialize reply. The same server worked in Cursor.

If your error says connection closed instead of unsupported, no token change will help. Update to a current Codex build, and confirm what transport the server really speaks, because an older SSE-style endpoint and a streamable HTTP endpoint are not interchangeable.

The five-minute checklist

1. Run codex --version and update if it is more than a couple of months old.
2. Run codex mcp get my-server and note whether the entry uses command or url.
3. For command entries, accept Unsupported and fix the server process instead.
4. For url entries, set bearer_token_env_var or run codex mcp login my-server.
5. Test the metadata with curl against /.well-known/oauth-protected-resource.
6. On macOS, try the mcp-remote bridge before spending an hour on theories.
7. Open /mcp in the TUI and confirm the server appears.

Debug With GPT 5.6 Sol on PicassoIA

When the config looks right and the error still shows up, a second reader helps. GPT 5.6 Sol is built for coding tasks and multi-step reasoning, and it accepts screenshots, so you can hand it the terminal output directly. It will not run Codex or touch your machine. It only reads what you paste.

Set up the request

1. Open GPT 5.6 Sol on PicassoIA.
2. In System Prompt, set the role: "You are a Codex CLI and MCP troubleshooter. Ask for missing facts before guessing."
3. In Prompt, paste your [mcp_servers.my-server] table and the output of codex mcp get my-server.
4. Add a screenshot of the failing terminal under Image Input.
5. Set Reasoning Effort to medium for most cases, or high for a tangled OAuth setup. The default, none, favors speed.
6. Raise Max Completion Tokens when you use high or xhigh, because heavy reasoning can use the whole budget and return an empty reply.
7. Pick Verbosity low for a short fix list or high for a full walkthrough.

💡 Replace every real token, client secret, and internal hostname with REDACTED before you paste anything.

Prompts worth sending

• "Here is my config entry and the output of codex mcp get. Which of the three auth checks is failing, and why?"
• "This server is stdio. Rewrite the entry so the credential reaches the process through env_vars."
• "Compare my OAuth setup against this resource URL and tell me where the audience could mismatch."

For a second opinion, Claude Sonnet 5 on the same platform is another strong option for reading configs and error output.

Make Your Own Images on Picasso IA

Fixing a login error is a good moment to build something with the tools that now work. Every photo in this article was generated with P Image on Picasso IA, from prompts that name the lens, the light, and the textures. You can do the same for your own docs, release notes, or project banners.

Three models worth opening next:

• Seedream 4.5 for sharp 4K images from a plain description
• GPT Image 2 when the prompt is long and detailed
• Flux 2 Pro for text-to-image and photo-based edits

Write one prompt, generate, adjust the lighting or the angle, and generate again. Once a still looks right, the platform's video tools can turn it into motion. Open Picasso IA, pick a model, and make your first image today.