# Codex MCP OAuth fails on both /mcp URL variants; CLI reports Premium Archive as Free

**URL:** <https://forum.newsblur.com/t/codex-mcp-oauth-fails-on-both-mcp-url-variants-cli-reports-premium-archive-as-free/13801>\
**Category:** problem\
**Created:** [August 11, 2026, 4:50pm UTC](https://forum.newsblur.com/t/codex-mcp-oauth-fails-on-both-mcp-url-variants-cli-reports-premium-archive-as-free/13801 "2026-08-11T16:50:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcelweiss](https://forum.newsblur.com/letter_avatar_proxy/v4/letter/m/d78d45/32.png) [@marcelweiss](https://forum.newsblur.com/u/marcelweiss)\
**Post date:** [August 11, 2026, 4:50pm UTC](https://forum.newsblur.com/t/codex-mcp-oauth-fails-on-both-mcp-url-variants-cli-reports-premium-archive-as-free/13801/1 "2026-08-11T16:50:52Z")

</div>

I am a Premium Archive subscriber, but cannot authenticate NewsBlur MCP with Codex on macOS.

With this Codex configuration:

```auto
[mcp_servers.newsblur]
url = "https://newsblur.com/mcp"

```

I get:

```auto
Error: Metadata error: Protected resource metadata resource mismatch:
reference 'https://newsblur.com/mcp',
permitted 'https://newsblur.com/mcp/'

```

With the trailing slash:

```auto
[mcp_servers.newsblur]
url = "https://newsblur.com/mcp/"

```

I get:

```auto
Error: Authorization server issuer mismatch:
expected https://newsblur.com/mcp,
received https://newsblur.com/mcp/

```

I logged out and retried, with the same results.

It looks as if the protected-resource metadata and OAuth authorization-server metadata use inconsistent canonical URLs (`/mcp` vs. `/mcp/`). Codex validates these URLs strictly, so neither documented URL variant works.

There may also be a related CLI issue. `newsblur auth status` reports `Tier: Free`, although this is the correct account and it has an active Premium Archive subscription. The CLI can retrieve my folder list, so authentication itself succeeded.

Could you check both the MCP OAuth metadata URL consistency and the subscription tier returned to the CLI/OAuth client?

---

<div class="post-metadata">

**Author:** ![samuelclay](https://forum.newsblur.com/user_avatar/forum.newsblur.com/samuelclay/32/857_2.png) [@samuelclay](https://forum.newsblur.com/u/samuelclay)\
**Post date:** [August 11, 2026, 10:17pm UTC](https://forum.newsblur.com/t/codex-mcp-oauth-fails-on-both-mcp-url-variants-cli-reports-premium-archive-as-free/13801/2 "2026-08-11T22:17:12Z")

</div>

Good catch, and thanks for the precise report. The two metadata documents disagreed on the canonical URL: the discovery metadata at the origin root advertised [https://newsblur.com/mcp/](https://newsblur.com/mcp/) with a trailing slash while the MCP server itself uses [https://newsblur.com/mcp](https://newsblur.com/mcp) without it. Codex validates those strictly, so both config variants failed. I’ve made everything consistent on the no slash form, which passes Codex’s validation for both URL styles. It will be live shortly, and then either url variant in your config.toml will work.

On the CLI: your account is correctly Premium Archive on the server and the account info endpoint returns the right tier. The bug was that when the CLI’s account info request fails for any reason, it silently showed Tier: Free instead of admitting it couldn’t fetch your info. The next CLI release shows Unknown plus the error instead. If you run newsblur auth status again it should say Archive.

---

<div class="post-metadata">

**Author:** ![marcelweiss](https://forum.newsblur.com/letter_avatar_proxy/v4/letter/m/d78d45/32.png) [@marcelweiss](https://forum.newsblur.com/u/marcelweiss)\
**Post date:** [August 13, 2026, 8:39am UTC](https://forum.newsblur.com/t/codex-mcp-oauth-fails-on-both-mcp-url-variants-cli-reports-premium-archive-as-free/13801/3 "2026-08-13T08:39:26Z")

</div>

Thanks.

MCP authentication works in Codex. CLI: `newsblur auth status` still showed `Tier: Free` earlier despite the account working now.

Thanks for the quick fix.