# ChatGPT MCP Connector OAuth: “OAuth state not found” — callback fails before token exchange
**Category:** ChatGPT Apps SDK / Bugs
**Tags:** mcp, connector, oauth, chatgpt-app
## Summary
ChatGPT’s own OAuth callback endpoint (`/backend-api/aip/connectors/links/oauth/callback`) returns 404 with `{“detail”:“OAuth state not found”}` during MCP connector setup. The entire OAuth discovery, DCR, and authorization flow completes successfully — ChatGPT generates the state, the user authenticates, and `code` + `state` are returned correctly — but ChatGPT’s backend cannot find the state it created. **The token exchange never happens** because the failure occurs before ChatGPT calls our `/oauth/token` endpoint.
This also reproduces with **OpenAI’s own `openai-mcpkit` TypeScript scaffold** using Auth0, confirming it is a platform-side issue.
## Environment
- **Plan:** ChatGPT Business
- **Developer Mode:** Enabled (Workspace Settings → Permissions & Roles → Connected Data)
- **App creation:** Workspace Settings → Apps → Create
- **MCP Server:** Cloudflare Worker at `mcp.auto.dev` (also tested with mcpkit scaffold via ngrok)
- **Auth Provider:** Custom OAuth 2.1 provider (id.org.ai) + Auth0 (for scaffold test)
- **Browser:** Chrome 146 on macOS
## What Works
- 
`POST /` → 401 with `WWW-Authenticate: Bearer resource_metadata=“…”` header
- `GET /.well-known/oauth-protected-resource` → 200 with valid metadata
- `GET /.well-known/oauth-authorization-server` → 200 with valid metadata
- `GET /.well-known/openid-configuration` → 200 with valid metadata
- `POST /oauth/register` (DCR) → 201 with `client_id`
- `GET /oauth/authorize` → 302 redirect to auth provider
- User authenticates and consents
- Auth provider redirects back to `chatgpt.com/connector/oauth/{id}?code=…&state=…`
- Both `code` and `state` parameters present and correctly formatted
## What Fails
- 
`POST chatgpt.com/backend-api/aip/connectors/links/oauth/callback → **\*\*404\*\*** \{“detail”:“OAuth state not found”}`
- `GET chatgpt.com/backend-api/aip/connectors/links/oauth/state/{state_id} → **\*\*404\*\*** \{“detail”:“OAuth state not found”}`
- No `POST /oauth/token` request ever reaches our server (verified via Cloudflare Workers tail logs and ngrok request inspector)
## Steps to Reproduce
1. Enable developer mode in workspace settings
2. Go to Apps → Create
3. Enter MCP Server URL, select OAuth authentication
4. ChatGPT discovers OAuth endpoints, performs DCR — all succeeds
5. Click Create → redirected to auth provider
6. Authenticate and consent
7. Redirected back to ChatGPT with valid `code` and `state`
8. **Error: “Something went wrong with setting up the connection”**
9. Browser console shows 404 on ChatGPT’s own callback/state endpoints
## Evidence: Server Logs (Cloudflare Workers Tail)
```
POST / 401 Unauthorized
GET /.well-known/oauth-protected-resource 200 OK
GET /.well-known/oauth-authorization-server 200 OK
GET /.well-known/openid-configuration 200 OK
GET /.well-known/oauth-authorization-server 200 OK
GET /.well-known/openid-configuration 200 OK
POST /oauth/register 201 Created
GET /oauth/authorize?.. 302 Redirect
← (no POST /oauth/token ever appears)
```
ChatGPT never reaches the token exchange step. The failure is entirely within ChatGPT’s backend state lookup.
## Evidence: Reproduced with OpenAI’s Own Scaffold
To rule out our server implementation, we cloned `openai/openai-mcpkit` (TypeScript scaffold), configured it with Auth0 (DCR enabled, default audience set, social connection), ran it locally via ngrok, and attempted the same connector setup flow. **Same result — “Something went wrong with setting up the connection.”**
ngrok request log from the scaffold:
```
POST /mcp 401 Unauthorized
GET /.well-known/oauth-protected-resource/mcp 404 Not Found
GET /mcp/.well-known/oauth-protected-resource 404 Not Found
GET /.well-known/oauth-protected-resource 200 OK
```
Discovery works (fallback to root path), but the connector still fails at the callback step.
## State Parameter Analysis
The state ChatGPT generates is base64-encoded JSON:
```json
{
“csrf”: “d06387cf7d5ba96b92b2587474bcd495691b2d14b059d584dca621669df3ed06”,
“s”: “oauth_s_69da6d33622081919e8b5e43c89ff601”
}
```
This state is preserved correctly through the auth flow — the exact same value appears in the redirect back to ChatGPT. ChatGPT’s backend simply cannot find the state record at `oauth_s_69da6d33622081919e8b5e43c89ff601`.
## Related Threads
- [ChatGPT MCP OAuth: callback timeout on token exchange]( ChatGPT MCP OAuth: callback timeout on token exchange (authorization code issued) ) (Sep 2025 — unresolved)
- [MCP Connector Creation Timeout - OAuth Callback Failing]( MCP Connector Creation Timeout - OAuth Callback Failing ) (Jan 2026 — unresolved)
- [ChatGPT Custom MCP OAuth fails to get tools when auth enabled]( ChatGPT Custom MCP OAuth fails to get tools when auth enabled ) (Jul 2025 — OpenAI acknowledged: “we are seeing posts in the Community forum about this, so we want to make sure we fix the issue if this is on our side”)
## Our Server Compliance Checklist
We’ve verified every requirement from the [OpenAI Auth Guide]( Authentication – Apps SDK | OpenAI Developers ):
| Requirement | Status |
|—|—|
| Protected resource metadata | (base + /mcp paths) |
| OAuth AS metadata | (base + /mcp paths) |
| OIDC discovery | (base + /mcp paths) |
| HTTP 401 + WWW-Authenticate header | |
| Per-tool securitySchemes | (all 15 tools) |
| Dynamic Client Registration | |
| PKCE (S256) | |
| Resource parameter (RFC 8707) | |
| Streamable HTTP transport | |
| HTTPS | |
## Questions for OpenAI
1. What causes `{“detail”:“OAuth state not found”}` on the callback? Is there a TTL on OAuth state, or is it tied to a specific backend instance?
2. Is this a known issue with the Business plan? The Help Center docs mention Business/Enterprise/Edu support.
3. Are there any server-side requirements not documented in the Apps SDK auth guide that could prevent state from being stored?
4. Can the team investigate the state storage for connector `eRvU93QmvGwc` on account `727a535d-e95d-4bb6-9f54-9961cca52582`?