Codex mcp login fails for Slack MCP with 'Dynamic client registration not supported'. How to work around it?
Running codex mcp login slack against Slack's official remote MCP endpoint (https://mcp.slack.com/mcp (opens external site)) fails immediately with 'Dynamic client registration not supported'. Slack does not support Dynamic Client Registration, so the login path Codex uses by default cannot complete.
Originally asked on GitHub: https://github.com/openai/codex/issues/13200
6 answers
Status: the DCR failure is expected for Slack's endpoint. One commenter reported that Codex 0.142.0 added a pre-registered OAuth client_id option that skips DCR, so on that version or newer it can be used. The same commenter said Slack requires the redirect URI to exactly match one registered on the Slack app, so the default random loopback port will not work.
Steps reported in the thread on 0.142.0 or newer:
- Set the callback overrides as top-level keys at the very top of config.toml, using the port and URL registered on your Slack app:
mcp_oauth_callback_port = mcp_oauth_callback_url = "http://localhost:/callback"
- Add the server with the pre-registered client ID:
[mcp_servers.slack] url = "https://mcp.slack.com/mcp (opens external site)"
[mcp_servers.slack.oauth] client_id = ""
- Run codex mcp login slack.
Another commenter reported that with the exact redirect matched, the browser flow completed but token exchange failed with 'missing field access_token'. Two commenters reported a different workaround: a Slack user token passed as a static bearer token via bearer_token_env_var, with the token kept in an environment variable. This requires the Slack app to have MCP/App Assistant access enabled, otherwise Slack returns 'App is not enabled for Slack MCP server access'. Tokens need renewing.
Security note: avoid hardcoding tokens in config.toml; keep them in an environment variable or a secret store.
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
Added url = "https://mcp.slack.com/mcp (opens external site)" under [mcp_servers.slack] and ran codex mcp login slack, which failed with 'Dynamic client registration not supported'.
Source: https://github.com/openai/codex/issues/13200 (opens external site)
Did this work for you?What @komod0 tried on GitHub (Worked)
Set mcp_oauth_callback_port and mcp_oauth_callback_url to match the redirect URI registered on the Slack app, then added [mcp_servers.slack.oauth] client_id set to the Slack app client ID on Codex 0.142.0 or newer and ran codex mcp login slack.
Source: https://github.com/openai/codex/issues/13200#issuecomment-4828614069 (opens external site)
Did this work for you?What @madeyexz tried on GitHub (Worked)
Registered a Slack app, minted a user token (xoxp) through manual OAuth code exchange, and set bearer_token_env_var = SLACK_MCP_TOKEN instead of using codex mcp login; enabled MCP server access on the app.
Source: https://github.com/openai/codex/issues/13200#issuecomment-4350613243 (opens external site)
Did this work for you?What @karloows tried on GitHub (Partly worked)
Tried the pre-registered Slack app OAuth route with the exact loopback redirect URI; browser auth completed but token exchange failed with 'missing field access_token'. Then used a Slack user token via bearer_token_env_var and enabled Slack MCP/App Assistant access on the app.
Source: https://github.com/openai/codex/issues/13200#issuecomment-5809855707 (opens external site)
Did this work for you?What @SproutSeeds tried on GitHub (Outcome unclear)
Reviewed the code path and found that codex mcp login always uses generic DCR and config lacks client_id/client_secret fields. Proposed a UX change to explain the limitation instead of the raw error.
Source: https://github.com/openai/codex/issues/13200#issuecomment-4080056356 (opens external site)
Did this work for you?