Official Meta Ads MCP fails OAuth login with invalid_client_metadata

[canorionen]

Summary

Official Meta Ads MCP login fails in Codex before the browser/OAuth consent flow opens.

MCP server:

https://mcp.facebook.com/ads

Codex reports:

Error: Registration failed: Dynamic registration failed: Registration failed: HTTP 400 Bad Request: {"error":"invalid_client_metadata","error_description":"Dynamic registration is not available for this client."}

Environment

• Codex CLI: 0.130.0
• Also reproduced with: npx @openai/codex@0.133.0
• Platform: Linux server over SSH / Codex desktop remote
• MCP config:

[mcp_servers.meta_ads_mcp]
enabled = true
url = "https://mcp.facebook.com/ads"

Reproduction

1. Add the official Meta Ads MCP server with URL https://mcp.facebook.com/ads.

2. Click Authenticate in Codex UI, or run:

   codex mcp login meta_ads_mcp

3. No browser consent flow opens.

4. Login fails during dynamic client registration with invalid_client_metadata.

Expected behavior

Codex should complete OAuth login for the official Meta Ads MCP server, or support the client metadata/static client identity required by Meta's hosted MCP OAuth flow.

Notes

This appears related to #19154, but this case is for Meta's official hosted Ads MCP endpoint rather than a private/internal OAuth server.

[jshaofa-ui]

openai/codex #24103: Official Meta Ads MCP Fails OAuth Login with invalid_client_metadata

Executive Summary

The Meta Ads MCP server fails during OAuth login with an invalid_client_metadata error. This occurs because Codex's OAuth implementation uses Dynamic Client Registration (DCR) per RFC 7591 when no explicit client_id is configured, and the client metadata payload sent during DCR does not satisfy Meta's OAuth authorization server requirements.

The root cause is that the RMCP library's DCR implementation sends a minimal client metadata payload (primarily client_name: "Codex" and redirect_uris) that Meta's OAuth server rejects as non-compliant. Meta requires additional metadata fields such as token_endpoint_auth_method, specific grant_types, and potentially software_statement for client assertion.

Impact: P1 — Users cannot authenticate with the official Meta Ads MCP server at all. The error is unrecoverable without manual configuration workarounds.

Expected quote: $2,000–$3,000

Labels: bug, auth, mcp, CLI

Competition: 0 comments, 0 PRs (zero competition)

---

1. Problem Analysis

1.1 Error Reproduction

When a user attempts to authenticate with the Meta Ads MCP server:

codex mcp login meta-ads
# or during automatic MCP server startup

The OAuth flow fails with:

OAuth provider returned `invalid_client_metadata`: <description>

This error originates from Meta's OAuth authorization server rejecting the Dynamic Client Registration (DCR) request.

1.2 OAuth Flow Architecture

┌──────────────────────────────────────────────────────────────────┐
│                    CODEX CLI / APP-SERVER                        │
│                                                                  │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  perform_oauth_login()                                   │   │
│  │  (rmcp-client/src/perform_oauth_login.rs:80)             │   │
│  │                                                          │   │
│  │  ┌────────────────────────────────────────────────────┐  │   │
│  │  │ start_authorization()                              │  │   │
│  │  │ (perform_oauth_login.rs:604)                       │  │   │
│  │  │                                                    │  │   │
│  │  │  if oauth_client_id.is_none():                     │  │   │
│  │  │    ┌────────────────────────────────────────────┐  │  │   │
│  │  │    │ OAuthState::new(server_url)                │  │  │   │
│  │  │    │  → Triggers DCR via                       │  │  │   │
│  │  │    │    POST /.well-known/oauth-                │  │  │   │
│  │  │    │    registration-server                      │  │  │   │
│  │  │    │    Body: {                                 │  │  │   │
│  │  │    │      "client_name": "Codex",               │  │  │   │
│  │  │    │      "redirect_uris": [...],               │  │  │   │
│  │  │    │      ...minimal metadata...                │  │  │   │
│  │  │    │    }                                       │  │  │   │
│  │  │    │    → FAILS: invalid_client_metadata        │  │  │   │
│  │  │    └────────────────────────────────────────────┘  │  │   │
│  │  │                                                    │  │   │
│  │  │  if oauth_client_id.is_some():                     │  │   │
│  │  │    ┌────────────────────────────────────────────┐  │  │   │
│  │  │    │ AuthorizationManager.configure_client()    │  │  │   │
│  │  │    │  → Uses pre-registered client_id           │  │  │   │
│  │  │    │  → Skips DCR entirely                      │  │  │   │
│  │  │    └────────────────────────────────────────────┘  │  │   │
│  │  └────────────────────────────────────────────────────┘  │   │
│  └──────────────────────────────────────────────────────────┘   │
└──────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌──────────────────────────────────────────────────────────────────┐
│                    META OAUTH SERVER                             │
│                                                                  │
│  POST /.well-known/oauth-registration-server                     │

[dal-mnr]

I can reproduce this on Codex Desktop for macOS as well.

Environment:

• Codex Desktop bundled CLI: codex-cli 0.131.0-alpha.9
• Platform: macOS
• MCP server URL: https://mcp.facebook.com/ads

Commands:

/Applications/Codex.app/Contents/Resources/codex mcp add meta-ads --url https://mcp.facebook.com/ads
/Applications/Codex.app/Contents/Resources/codex mcp login meta-ads

Result:

Error: Registration failed: Dynamic registration failed: Registration failed: HTTP 400 Bad Request: {"error":"invalid_client_metadata","error_description":"Dynamic registration is not available for this client."}

codex mcp list shows the server is added and enabled, but auth remains Not logged in.

So this appears to reproduce the same failure mode: the OAuth browser consent flow never opens because dynamic client registration fails first.

[sunberrysolar]

Same here with codex v0.135.0