Overview
This article addresses how to successfully configure the Codex CLI to authenticate through the Aembit MCP Gateway. It details the implemented solution required to establish connectivity using Dynamic Client Registration (DCR) combined with explicit loopback path matching.
Relates To
MCP Client: Codex CLI
Aembit Component: MCP Gateway, Client Workload, Access Policy
Resources/Tooling: Dynamic Client Registration (DCR), OIDC Authentication
Cause
During the authentication callback process, the Codex CLI utilizes a unique, per-URL hash suffix for its local server. If the Aembit Client Workload is not explicitly configured to match this generated Redirect URI, the OIDC callback flow will fail to route correctly. Using the --oauth-client-registration dcr flag and pre-defining the exact loopback path resolves this mismatch.
Resolution
To establish a working connection, you must retrieve the unique callback suffix for your gateway, configure the Aembit Access Policy appropriately, and initialize the connection in Codex.
1. Retrieve the Explicit Per-URL Hash
First, calculate the explicit callback suffix for your specific MCP Gateway URL. Run the following script in your terminal (update the GATEWAY_URL variable to match your specific environment):
Bash
GATEWAY_URL="https://<tenant_id>.mcpgateway.aembit.io/mcp"
SUFFIX=$(echo -n "$GATEWAY_URL" | openssl dgst -sha256 -binary | base64 | tr '+/' '-_' | tr -d '=' | cut -c 1-12)
echo "Callback suffix: /callback/$SUFFIX"
Example Output:
Callback suffix: /callback/-TjYJ8XYzaSK