ChatGPT MCP OAuth: callback timeout on token exchange (authorization code issued)

ChatGPT Bugs
,
1

Authorization succeeds and redirects back to ChatGPT with code.

Browser calls ChatGPT callback endpoint:

  • POST /backend-api/aip/connectors/links/oauth/callback
  • Body: {“full_redirect_url”:“connector_platform_oauth_redirect?code=…&state=…”}

ChatGPT returns {“detail”:“Request timeout”}.

Discovery endpoints on our side are OK (200). Issue appears during token exchange hop on
ChatGPT’s servers when they call our token endpoint.

Environment

[OUR-DOMAIN] = api[.]agentsfera-test[.]hc1[.]blogic[.]ai

OAuth endpoints (ours):

  • authorize: [OUR-SERVER]/api/auth/mcp/authorize
  • token: [OUR-SERVER]/api/auth/mcp/token

Discovery (ours, all 200):

  • /.well-known/oauth-authorization-server/mcp
  • /.well-known/oauth-authorization-server
  • /.well-known/openid-configuration
  • /.well-known/oauth-protected-resource

Steps To Reproduce

  1. Start connector OAuth in ChatGPT, complete consent; ChatGPT is redirected back with a valid
    code.
  2. Browser posts to ChatGPT callback endpoint with authorization code
  3. Response from ChatGPT: {“detail”:“Request timeout”}.

Expected
ChatGPT should exchange the code against our token endpoint and return success, completing
connector linking.

Actual
ChatGPT callback returns a timeout JSON; connector linking fails at the token step.

What’s verified working

  • OAuth discovery: all well-known endpoints return valid JSON (issuer, authorization/token
    endpoints, registration_endpoint). MCP-specific path is live.
  • Authorization step: user auth + code issuance OK; redirect back to ChatGPT OK.

Timing Analysis
Our token endpoint typically responds in under 500ms:

  • Local test: ~200ms
  • External test: ~400ms
  • Load test: p95 under 800ms

Suggesting the timeout might be in network connectivity between ChatGPT’s servers and our
endpoint rather than our handler performance.

Questions for OpenAI

  • What timeout threshold does the callback endpoint enforce for the downstream token exchange? Is
    there a retry?
  • Can you confirm the exact request ChatGPT makes to our token endpoint and any error details you
    see upstream?
  • Are there any IP ranges or egress policies we should allowlist for ChatGPT’s token exchange
    calls?

Notes

  • Can provide exact server details via DM if needed for debugging
  • The failure happens on ChatGPT’s callback endpoint; browser shows {“detail”:“Request timeout”}
  • We can share precise latency metrics from our token endpoint once requested
ChatGPT MCP Connector OAuth: "OAuth state not found" — callback fails before token exchange