Codex: "OAuth state not found" when connecting a plugin or MCP, how to fix it

You click connect on a plugin in the Codex app (GitHub, Slack, Webflow, OpenAI Developers or your own MCP), finish the authorization in the browser with no error at all, return to the app and get the toast OAuth state not found. The plugin stays disconnected.

The error has been reported since 2026-10-16 in at least three issues on the official openai/codex repository (#54924, #54626 and #55314), on Windows and macOS, with app version 26.1013. As of 2026-10-20 OpenAI has not published a cause or a fix.

Why does Codex show "OAuth state not found"?

Because OpenAI's server does not recognize the connection the app itself just started. Reports with app logs show the call POST /aip/connectors/links/oauth/callback returning HTTP 404 with {"detail":"OAuth state not found"} 3 to 9 seconds after the app registered the attempt.

It is not an expired token or a stale browser tab: the app receives the redirect normally and the log marks the callback as its own. The failure is on the hosted route, so nothing you change on your machine fixes the root cause. What you can do is work around it, and the workaround depends on the kind of connection.

How do you fix it for a hosted plugin (GitHub, Slack, Webflow)?

Sign in to chatgpt.com in your default browser, with the same account as the app, and retry the connection from the app. That is what fixed the GitHub connection reported in #55314.

1. In the system default browser, open chatgpt.com and confirm you are signed in to the same account as the Codex app.
2. Go back to the app, open Plugins and click connect again.
3. Finish the authorization in the browser and return to the app.

It is not guaranteed. In #54924 another user signed out and back in to ChatGPT web and the Webflow error remained. If it does not work, stop recreating the connector: in #54924 a connector registered from scratch failed the same way, and with a custom MCP the broken plugin may even become impossible to delete (#54626).

How do you connect your own MCP without the plugin flow?

Register the server directly in the local Codex config and run OAuth from the CLI. This path runs OAuth from the local process and skips the hosted route that returns 404. The official MCP docs say the desktop app, the CLI and the IDE extension share the same configuration in ~/.codex/config.toml, so the server shows up in the app too.

codex mcp add my-mcp --url https://your-server.example/mcp

If the server advertises OAuth support, add starts the flow on its own and the CLI prints Detected OAuth support. Starting OAuth flow…. To log in again later, or if the browser did not open:

codex mcp login my-mcp

OAuth login only works for HTTP (streamable HTTP) servers. For a local server added with --command, the CLI refuses with OAuth login is only supported for streamable HTTP servers.

Which codex mcp login options help here?

Three flags, all checked in the codex-rs/cli/src/mcp_cmd.rs source on 2026-10-20:

codex mcp login my-mcp --oauth-client-registration cimd

Check the result with codex mcp list. To delete the saved credentials and start over, use codex mcp logout my-mcp. If a firewall requires a fixed port for the OAuth redirect, the docs point to the mcp_oauth_callback_port key in config.toml.

What if none of this works?

Post the app's Feedback ID on issue #54924, which collects the reports. The most useful comments there include app version, OS, the UTC time of the attempt and the affected provider, with no tokens or callback URLs. A hosted plugin depends on a fix on OpenAI's side.