What exactly happens when I unpublish a published app version? (OAuth client registration is locked)

GPT builders
, , ,
1

I have an app published in the ChatGPT app directory and I’m stuck on an OAuth
change. Before I click Unpublish I’d like to understand what it actually does,
because I can’t find it documented anywhere.

My situation

  • v1.0.0 is Published and live in the directory.
  • v2.0.0 exists as a Draft.
  • I need to change the OAuth Client ID.

In the version editor, under MCP > Advanced settings, the Client ID field is
read-only and the UI says:

This app already has an OAuth client. Client registration is locked after
OAuth setup completes.

Registration method is fixed at “Pre-defined”. The OAuth endpoint fields
(Auth URL, Token URL, Authorization server base) are editable, and the Client
Secret field accepts a new value — but the Client ID itself is locked. Editing
the v2.0.0 draft does not unlock it.

Two things make this hard to work around:

  1. My authorization server is Amazon Cognito, and Cognito generates app client
    IDs itself — ClientId is not an input parameter to CreateUserPoolClient, so
    I cannot create a new client that reuses the ID the portal has stored.
  2. Creating a brand-new plugin isn’t an option either, since the portal won’t
    accept another app on the same MCP server origin.

So as far as I can tell, the locked field is the only thing standing between me
and a working OAuth config.

What I’d like to know

  1. Does unpublishing the current version unlock client registration, or is the
    lock tied to OAuth setup completion regardless of publication state?
  2. Is Unpublish reversible? Can I publish the same approved version again later,
    or does it require a new review?
  3. What happens to users who already have the app connected while it’s
    unpublished — does the existing connection keep working?
  4. Is there any supported way to reset client registration on an existing app
    without creating a new one?

The docs on how published MCP metadata versions work cover what requires a new
version, and mention removing a version from publication as the way to take an
app out of public visibility, but they don’t say whether that’s reversible or
whether it releases the OAuth client lock.

Any clarification from the team OpenAI_Support would help — right now I’d be clicking Unpublish
without knowing if I can undo it.