Document OpenAI MCP OAuth setup

[omarbenhamid]

[omarbenhamid]

@lairevett as you have experience with Open AI MCP setup, would you have time to comment #3 with some blueprints ? I envision to include this in the readme for following releases.

[msadowski-gh]

@lairevett as you have experience with Open AI MCP setup, would you have time to comment #3 with some blueprints ? I envision to include this in the readme for following releases.

The prerequisites are exactly the same as for Claude with one caveat, OpenAI appends an empty ?scope= to the /authorize request.

It seems they doesn't follow OAuth2 spec strictly here, since according to RFC 6749 sections 3.3 and 4.1.1 the scope parameter is optional but must be non-blank if present in query params:

scope       = scope-token *( SP scope-token )
scope-token = 1*( %x21 / %x23-5B / %x5D-7E )

In practice OAuthLib treats "?scope=" as the literal scope "", and DOT rejects that with invalid_scope error unless "SCOPES": {"": "<description>", ...other scopes} is registered in settings.OAUTH2_PROVIDER.

There are a few ways to workaround that, I ended up overriding oauthlib.oauth2.Server.validate_authorization_request like so:

from oauthlib.common import Request
from oauthlib.oauth2 import Server
from oauthlib.oauth2.rfc6749 import utils as rfc6749_utils
from oauthlib.oauth2.rfc6749.endpoints.base import catch_errors_and_unavailability


class OAuth2Server(Server):
    @catch_errors_and_unavailability
    def validate_authorization_request(self, uri, http_method="GET", body=None, headers=None):
        request = Request(uri, http_method=http_method, body=body, headers=headers)
        scope = request.scope or self.request_validator.get_default_scopes(request.client_id, request)
        request.scopes = rfc6749_utils.scope_to_list(scope)
        response_type_handler = self.response_types.get(request.response_type, self.default_response_type_handler)
        return response_type_handler.validate_authorization_request(request)

And then changed settings.OAUTH2_PROVIDER["OAUTH2_SERVER_CLASS"] to "path.to.package.OAuth2Server"

After that change, empty ?scope= behaves the same as if it wasn't provided in the /authorize request at all. The user is asked for access to settings.OAUTH2_PROVIDER["DEFAULT_SCOPES"] or all settings.OAUTH2_PROVIDER["SCOPES"] in case DEFAULT_SCOPES aren't configured.

To my knowledge, as of today MCP integration is available through:

• ChatGPT Connectors, it's not available for ChatGPT Plus or Free users here yet, ChatGPT Team, Pro and Enterprise subscribers will see "Create" button in the upper right corner, usable with Deep Research only
• OpenAI Prompt Playground, though that doesn't support OAuth, there are only API Key/No Authentication options
• OpenAI API

[omarbenhamid]

Thanks, that's interesting, will be adding this feedback to the README.