MCP Oauth failes via CLI but works with the Desktop app

What version of Codex CLI is running?

0.144.5

What subscription do you have?

Pro

Which model were you using?

gpt-5.6

What platform is your computer?

Darwin 25.3.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

No response

What issue are you seeing?

Trying to authenticate an OAuth 2.0 MCP server works perfectly fine when attempting via the Desktop app but fails in the CLI.
In both the OAuth redirect screen opens, but after approving the CLI shows:

Error: failed to handle OAuth callback

Caused by:
    Authorization server response missing required issuer: expected https://clerk.getswan.com

What steps can reproduce the bug?

I can't provide a mock user to our production user to produce exactly, but the order of actions was:

1. codex mcp add swan-test-auth --url https://mcp.getswan.com/mcp/org/
2. codex mcp login swan-test-auth
3. approved the oauth in the browswer
4. the browser window shows: Authentication complete. You may close this window.
5. the terminal then shows the Authorization server response missing required issuer... message

What is the expected behavior?

No response

Additional information

No response

Start with the codex mcp add and codex mcp login CLI flow, focusing on OAuth callback handling after approval. Compare the CLI behavior with the Desktop app's successful authentication and investigate why the callback reports a missing issuer for https://mcp.getswan.com/mcp/org/<id>. Done means the CLI completes authentication without the issuer error.