Developer MCP app: OAuth and /token succeed, then ChatGPT 404s its own plugin (Plugin not found) and never calls /mcp

ChatGPT Apps SDK
, , , ,
1

I’ve got a custom MCP server (reachmy.ai) that’s been working in ChatGPT developer mode. Last week I could add it, complete OAuth, and use the tools. This weekend I deleted the old ReachMy apps in ChatGPT and created one clean new one. OAuth still completes on my side. ChatGPT then immediately says the plugin failed to connect, and the tools never load.

I’m pretty sure this is dying inside ChatGPT after the token exchange, not on my authorization server. Posting here because other MCP OAuth threads look related, but my failure is a step later than most of them.

What still works on my server

  • Discovery: /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server both 200
  • DCR: POST /reg → 201
  • Consent / authorization code: succeeds
  • Redirect back to ChatGPT with code, state, and iss=https://mcp.reachmy.ai
  • ChatGPT then calls my token endpoint twice:
    • POST /token (authorization_code) → 200
    • POST /token (refresh) → 200 a few seconds later
  • Client and grant are still sitting in my DB. Nothing got revoked.

Fresh client from this attempt:

  • client_id: c1Xch991rynzOlWX2-OfwMGuu-z8Drict915m8sy7Fh
  • redirect_uri: https://chatgpt.com/connector_platform_oauth_redirect
  • resource: https://mcp.reachmy.ai/mcp
  • window: 2026-08-30 ~11:27–11:31 UTC

What ChatGPT shows after that

  • Plugin page: “There was a problem connecting reachmy.ai. Try again later.”
  • Same page also says Connected Aug 30, 2026, URL https://mcp.reachmy.ai/mcp, Authorization = OAuth
  • Console: Uncaught (in promise) Error: Plugin not found
  • Network: 404 on a chatgpt.com request that looks like backend-api/ps/plugin… (path is truncated in my screenshot)
  • New chat: ReachMy tools don’t load

The important part

After those two successful /token responses, my server gets zero POST /mcp. No initialize, no tools/list, nothing. ChatGPT never sends me the bearer token.

So this is not “my token endpoint failed” and not “my MCP rejected the token.” ChatGPT has the tokens, then 404s its own plugin object, then never talks to MCP.

That’s different from the “OAuth state not found” threads, where ChatGPT 404s /backend-api/aip/connectors/links/oauth/callback before /token. I already got past /token.

What changed vs last week

Last week’s working ChatGPT DCR clients registered the old callback-id redirect:

https://chatgpt.com/connector/oauth/6mt_L_yi2KyC

The new apps ChatGPT created on Aug 29 and Aug 30 registered the stable one:

https://chatgpt.com/connector_platform_oauth_redirect

I did not change that. ChatGPT sent it during DCR. My AS advertises authorization_response_iss_parameter_supported: true and I return iss on the callback, which matches the current docs for the stable redirect.

I also cleaned up the old ReachMy developer apps and created a brand-new one, so this is a fresh ChatGPT app + fresh DCR client, not the old revoked one.

What I need from OpenAI

  1. Why does backend-api/ps/plugin… 404 with Plugin not found after a successful OAuth callback and /token 200?
  2. Is the new app failing to attach to a plugin/connector record when using connector_platform_oauth_redirect + DCR?
  3. Can someone look at this connector/app around 2026-08-30 11:27 UTC for client c1Xch991rynzOlWX2-OfwMGuu-z8Drict915m8sy7Fh?

Happy to add a sanitized HAR of the plugin 404. I’m not going to keep creating more apps — this one is the clean repro.

Why it worked last week and doesn’t now

Two things changed. Only one of them is on your side, and it is not “ReachMy started rejecting ChatGPT.”

1. You threw away the old ChatGPT apps.
Last week ChatGPT had an older ReachMy app whose DCR client used https://chatgpt.com/connector/oauth/6mt_L_yi2KyC. That path had already completed OAuth and, at least once, actually talked to ReachMy. This weekend you deleted those apps and made a new one. ChatGPT minted a new plugin object and a new OAuth client. The new object is what 404s (Plugin not found) after OAuth. ReachMy still issued tokens for that new client. ChatGPT then lost the plugin record and never called /mcp.

2. ChatGPT changed which redirect it registers.
Same ReachMy server. New ChatGPT apps now register connector_platform_oauth_redirect because you advertise and return iss (that’s the current OpenAI rule). Your security spikes did not flip that on. The old working clients were on the callback-id URL. The two newest ones (Aug 29 and Aug 30) are on the stable URL. ReachMy accepted both. Only the new ChatGPT-side app/plugin binding is failing.

The Phase 3.5 deploys (consent, DCR policy, grant-rebind, log tracing) did not break this attempt. If they had, you’d see /reg fail, consent fail, /token 400, or /mcp 401. You got /token 200 twice and no /mcp at all.

So: last week you were on an older ChatGPT app + older redirect contract that still resolved. This week you’re on a brand-new ChatGPT developer app on the stable-redirect/DCR path. ReachMy still finishes OAuth. ChatGPT’s plugin registry does not. That’s why other published plugins can keep working while this one is dead.