Missing 'openid' scope in dynamically registered OAuth clients

ChatGPT Apps SDK
1

When adding a new app, ChatGPT automatically creates an OAuth client using Dynamic Client Registration. However, the generated client does not include the openid scope. As a result, subsequent authentication attempts fail because ChatGPT requests the openid scope during the authorization flow, which the client has not been configured to support.

Our .well-known/oauth-protected-resource includes scopes_supported with openid included.

We are using Clerk as our auth server.

Anyone experiencing same issue?

1 Like
2

@mikkokutilainen I am experiencing the same, Did you manage to find a workaround for this?

3

Hi @mikkokutilainen @Mohamed_Mamdouh , we encountered the same issue.

You may be able to go in and manually add openid after the initial registration, but this is sometimes tricky with the timing. Another solution is to manually create the client in Clerk with openid and the other fields included, and then add the Oauth client ID and Oauth client secret manually when creating the App in ChatGPT (screenshot attached).

Let me know if either of these work for you, or if you find a more reliable way to get openid working with DCR.

Screenshot 2026-02-23 at 3.54.18 PM
Screenshot 2026-02-23 at 3.54.18 PM788Ă—1402 68.7 KB

4

Hi @Evan_Fenster
Second way conceptually should work but it does not take advantage of oAuth Dynamic Registration feature in clerk and definitely will need more development effort.

I am trying a work around now and if worked will share it shortly

5

Hey @mikkokutilainen @Mohamed_Mamdouh, yeah, that’s a confusing one.

When using DCR, ChatGPT handles the OAuth client creation automatically, but it still depends on the provider correctly supporting standard OAuth/OIDC behavior, as outlined in the Developer Mode & MCP Apps guide. If a required scope isn’t included at registration time but is later requested during auth, the flow can fail.

Quick checks that would help:

  • Is openid present in the DCR request and Clerk is dropping it?
  • Or is it missing already in the registration payload?
  • Rough timestamp with timezone of a failed attempt?

If this happens consistently with a fresh app and fresh DCR, that’s useful signal. Let’s narrow down whether this is Clerk specific or something broader.

1 Like
6

@OpenAI_Support Thanks for the input, Just FYI, Regarding Clerk, my same MCP server when being used with Claude the web app, it requests the scopes and i can see it in Clerk. So I don’t think the issue related to Clerk