Meta Ads MCP OAuth fails before browser login in Codex 0.153.4 (endpoint origin validation)

Local reproduction on macOS, 2026-09-10. The official Meta endpoint is configured as Streamable HTTP:

[mcp_servers.meta_ads]
url = "https://mcp.facebook.com/ads"
enabled_tools = []
default_tools_approval_mode = "prompt"

Running codex mcp login meta_ads fails before browser login:

OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

Public Meta discovery metadata observed on 2026-09-10:

• Resource and authorization server: https://mcp.facebook.com/ads
• Issuer: https://mcp.facebook.com/ads
• Authorization endpoint: https://www.facebook.com/v26.0/dialog/oauth
• Token endpoint: https://graph.facebook.com/v26.0/oauth/access_token
• authorization_response_iss_parameter_supported: absent

The same endpoint is shown as connected in Claude Desktop, with its tool catalog visible. No Claude credentials were copied and no authenticated Meta data query was performed in this investigation.

The official rust-v0.154.0 source still rejects this combination in codex-rs/rmcp-client/src/oauth/issuer_binding.rs. That release was inspected, not installed or executed. No Meta exception appears there. A pre-registered client does not by itself resolve the observed endpoint-origin mismatch.

Request: Please provide a supported Meta-compatible OAuth flow that preserves issuer validation, or coordinate RFC 9207 issuer-bound authorization response support with Meta. Please clarify whether a supported alternative authentication path exists for this endpoint.

Related reports (different historical failures; not proof of a fix):

• https://github.com/openai/codex/issues/38944
• https://github.com/openai/codex/issues/24103
• https://github.com/openai/codex/issues/35459
• https://github.com/openai/codex/issues/41677

Source inspected:
https://github.com/openai/codex/blob/rust-v0.154.0/codex-rs/rmcp-client/src/oauth/issuer_binding.rs

Start by reading codex-rs/rmcp-client/src/oauth/issuer_binding.rs and compare its issuer and authorization-endpoint validation with the Meta discovery metadata described here. Done would require a supported Meta-compatible OAuth flow that preserves issuer validation, or a documented supported alternative authentication path.