MCP OAuth cannot send pre-registered client_secret for Google Workspace MCP

Summary

Codex can complete the Google OAuth authorization flow for Google Workspace MCP, but the token exchange fails because no OAuth client secret is sent:

OAuth token exchange failed:
invalid_request: client_secret is missing

Google Workspace MCP's official configuration uses a Google Web OAuth client and requires both client_id and client_secret.

Environment

• ChatGPT app: 26.803.41515
• Bundled Codex CLI: 0.147.0-alpha.6.5
• MCP endpoint: https://gmailmcp.googleapis.com/mcp/v1

Steps to reproduce

1. Configure the Google Workspace/Gmail MCP endpoint in Codex.
2. Configure the pre-registered OAuth client_id (the current documented per-server OAuth setting).
3. Run the MCP OAuth login flow.
4. Complete the Google authorization screen, account selection, and scope consent.
5. Observe that the callback contains iss=https://accounts.google.com.
6. Observe the token exchange error:

OAuth token exchange failed:
invalid_request: client_secret is missing

The previous error, Authorization server response missing required issuer, no longer occurs in this environment.

Expected behavior

Codex should support a secure per-MCP-server configuration for a pre-registered/confidential OAuth client, including client_secret, and send it to the token endpoint as required by the provider. The secret should be handled through an appropriate secure local/app credential store rather than exposed in logs.

Actual behavior

The available/documented MCP OAuth configuration exposes client_id, but I could not find a supported per-server client_secret setting in the current CLI/App configuration. As a result, Google rejects the authorization-code token exchange.

Google's official MCP setup documentation requires a Web OAuth client with both values:
https://developers.google.com/workspace/guides/configure-mcp-servers?hl=en

Related issues

• RFC 9207 issuer handling: #31573
• Google Workspace MCP reports: #34427, #34684
• Pre-registered/static OAuth client identity: #19154
• Slack MCP requiring a pre-registered client identity: #13200
• Related MCP OAuth configuration discussion: #35253

Request

Please add support for pre-registered OAuth client credentials for remote MCP servers (at minimum a secure client_secret path), or document an official supported workaround for providers such as Google Workspace MCP that require a confidential Web OAuth client.

Start by tracing the MCP OAuth login flow from the current per-server OAuth configuration through the token endpoint request in the Codex CLI/App configuration. Determine how a pre-registered client_secret can be stored securely and excluded from logs. Done means Google Workspace MCP can complete the token exchange with both client_id and client_secret, or an official supported workaround is documented.