Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

MCP StreamableHttp: OAuth is attempted when static auth uses a non-Authorization header

Open Beginner friendly
  • Is something wrong?
#48,037 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
authentication, networking

Research direction

Start in codex-rs/rmcp-client/src/rmcp_client.rs, inspecting the auth_provider selection and build_default_headers behavior. Reproduce with the provided x-api-key configuration, then verify that any configured static http_headers or env_http_headers entry prevents the OAuth attempt and allows the StreamableHttp connection to authenticate.

Written by the indexing model from the issue text.

Description

auth bug mcp

Summary

When an MCP StreamableHttp server is configured with a static auth header that is not Authorization (for example x-api-key), Codex still attempts the OAuth handshake and the connection fails, even though a valid static credential was supplied.

Where

In codex-rs/rmcp-client/src/rmcp_client.rs, the OAuth auth_provider is suppressed only when the request carries an Authorization header:

let auth_provider =
    if bearer_token.is_some() || default_headers.contains_key(AUTHORIZATION) {
        None
    } else {
        auth_provider.clone()
    };

build_default_headers correctly attaches every http_headers / env_http_headers entry (including a non-Authorization header), but because the check keys on AUTHORIZATION specifically, a server authenticated purely by x-api-key keeps its OAuth auth_provider and triggers an OAuth flow.

Reproduce

Configure a StreamableHttp MCP server whose only auth is a custom header:

mcp_servers.example.url = "https://mcp.example.com"
mcp_servers.example.env_http_headers."x-api-key" = "EXAMPLE_KEY_ENV"

with EXAMPLE_KEY_ENV set to a valid key, against a server that uses x-api-key and offers no OAuth. Codex attempts OAuth and the connection fails; the server reports a missing Authorization header.

Expected

Any configured static auth header — via http_headers or env_http_headers, not only Authorization — should suppress the OAuth path. A server may legitimately authenticate with x-api-key, X-Api-Token, or similar.

Version

Observed in 0.144.1; the same condition is present on the latest tag.

Dominant language
Rust
Stars
125k
Forks
19.5k
Avg merge
1m
Merged PRs (30d)
996

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openai/codex

All issues in openai/codex

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.