Short answer
Copy the redirect URI from the MCP server’s page in ChatGPT and allowlist exactly that address on your authorization server. ChatGPT uses one of two addresses, depending on whether your authorization server supports issuer identification. Then check that your authorization server metadata advertises S256 PKCE and a way for ChatGPT to get a client ID: CIMD, dynamic client registration or a predefined client.
Why ChatGPT rejects the sign-in, and the fix
01
The redirect address isn’t the one ChatGPT uses
“Copy the exact production redirect URI shown in the MCP server's management page into your authorization server's allowlist.” OpenAI, Authentication
ChatGPT uses https://chatgpt.com/connector_platform_oauth_redirect when your authorization server supports issuer identification, and a callback-specific address of the form https://chatgpt.com/connector/oauth/{callback_id} when it doesn’t. Servers published before ChatGPT introduced callback-specific redirects keep the stable address. Allowlisting the wrong one makes the authorization server reject the request.
02
The issuer you return doesn’t match
“clients use exact string comparison and do not normalize trailing slashes, paths, ports, or casing.” OpenAI, Authentication
If your metadata sets authorization_response_iss_parameter_supported to true, every authorization response, including errors, must return an iss value that matches the metadata issuer exactly, and the same issuer must appear in your protected resource metadata. A trailing slash or different casing is enough to fail.
03
The metadata is missing a required field
“MCP servers are unsupported when their authorization server metadata omits this field or does not advertise S256” OpenAI, Authentication
Your authorization server metadata must list S256 under code_challenge_methods_supported, or ChatGPT treats the server as unsupported. It also needs a way to register: client_id_metadata_document_supported set to true for CIMD, or a registration_endpoint for dynamic client registration, plus the token endpoint auth methods you accept.
Checked against the vendor’s docs on : OpenAI: Plugin authentication; MCP specification: Authorization (2025-11-25).
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- $2,500MCP Connector for your SaaSAn MCP server over your existing REST API, so your product works inside Claude, and in ChatGPT with OAuth sign-in.See scope and start
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
Related: Claude connector authorization failed · Google sign-in redirect_uri_mismatch · MCP server authentication: API keys vs OAuth