Bug: Mixed Auth fails when publishing app (406 / 400 on /mcp)

ChatGPT Apps SDK
, ,
1

Summary

When trying to publish an app on the OpenAI Platform using the Apps SDK with Mixed Auth, the publishing flow fails during the tool scanning step.
The platform sends a POST /mcp request which returns an error (406 in TypeScript, 400 in Python), preventing the publishing process from completing.

The issue only occurs with Mixed Auth. Using OAuth or No Auth works as expected.

Steps to Reproduce

Image
Image945×697 54.2 KB

  • Attempt to publish the app on the OpenAI Platform
  • During the publishing flow, the platform attempts to scan tools
  • The platform sends a POST request to /mcp
  • The request fails and publishing cannot continue

Actual Behavior

TypeScript

  • POST /mcp returns 406 Not Acceptable

Python

  • POST /mcp returns 400 Bad Request
  • Warning/error message:
    Invalid Content-type: text/octet-stream

Expected Behavior

When using Mixed Auth, the platform should successfully call /mcp, scan the tools, and allow the publishing process to proceed, the same as with OAuth or No Auth.

Additional Context

This error blocks the tool scanning step, making it impossible to publish apps that require Mixed Auth.

1 Like
2

Hey, @Gabriel_Camargo , do you happen to have an example repository? Did anything change? Or was this just a straight copy of the example above?

1 Like
3

Hey @benlesh! I actually ran into this issue while working on a private project. To rule out whether it was something specific to my application or a platform issue, I also tested using the example repository.

I basically cloned the repo, configured Auth0, set the environment variables, ran it using ngrok, and then tried to go through the login flow and scan the tools. The login itself works fine, but when returning to the platform, the tools are not scanned.

So the behavior seems to be the same both in my private project and in the example repo.

2 Likes
4

Alright, thanks for letting me know. I’ll make sure there’s a ticket around it.

3 Likes