ChatGPT sign-in rejects a pasted callback URL that has no http:// prefix #21743

What happened

I signed in with ChatGPT from app.t3.codes over T3 Connect. The T3 server runs on a separate headless machine. ChatGPT redirected to the loopback callback, and that page could not load on my device, which is expected. I copied the URL from the address bar and pasted it into the callback box. T3 replied "This redirect URL does not belong to the active ChatGPT sign-in." I retried more than 20 times across four sign-in attempts and got the same error each time.

The copied URL had no scheme. It looked like 127.0.0.1:59815/auth/callback?code=...&scope=...&state=...&client_id=oaiapp_.... When I typed http:// in front of it, sign-in worked on the first try.

Diagnosis

codexCallbackUrl in packages/shared/src/codexAuthHandoff.ts (line 58 on main) starts with new URL(value). A value without a scheme, such as 127.0.0.1:59815/auth/callback?..., throws ERR_INVALID_URL. The catch in apps/server/src/provider/CodexChatGptAuth.ts replaces every error from that function with "This redirect URL does not belong to the active ChatGPT sign-in." Because of that, a parse failure gets the same message as a state mismatch. The user has no way to tell that only the prefix is missing.

The web client (apps/web/src/components/settings/ProviderAuthenticationSection.tsx) sends the pasted value as is. Neither the client nor the server adds a missing http://. I checked v0.1.0 and current main, and the behavior is the same in both.

Browsers often drop the scheme. Mobile Safari, for example, hides http:// in the address bar, so a copied address can come without it. The paste box exists for remote setups, where the callback can't reach the server, so these users are the ones most likely to hit this.

Possible fixes:

• Add http:// to the pasted value when it starts with 127.0.0.1: or localhost:, before validating it. The origin, path, and state checks would still run afterward.
• Or give parse failures their own error, for example "Paste the full URL, starting with http://".

Steps to reproduce

1. Run T3 Code on a machine that is not the device with the browser, and connect to it through app.t3.codes.
2. Open Settings, start "Sign in with ChatGPT" on a managed Codex instance, and finish the ChatGPT login.
3. Copy the callback URL from the page that failed to load, without the http:// prefix: 127.0.0.1:<port>/auth/callback?code=...&state=....
4. Paste it into the callback box and submit. The error says the URL does not belong to the active sign-in.
5. Start again, paste the same kind of URL with http:// added in front, and sign-in succeeds.

Version

0.1.0

Environment

Server: Raspberry Pi OS (Debian, arm64), T3 Code 0.1.0 as a systemd user service, bundled codex-cli 0.156.1. Client: app.t3.codes through T3 Connect in Safari on iPadOS 27.0.1. Safari shows the address without http://, so the copied callback URL came without it.

Evidence

# server.trace.ndjson, one sign-in attempt (timestamps UTC)
14:30:21 ws.rpc.provider.auth.start      Success
14:30:43 ws.rpc.provider.auth.complete   Failure  ProviderSetupError: This redirect URL does not belong to the active ChatGPT sign-in.
14:31:11 ws.rpc.provider.auth.complete   Failure  (same)
14:31:13 ws.rpc.provider.auth.complete   Failure  (same)
14:31:15 ws.rpc.provider.auth.complete   Failure  (same)
14:31:30 ws.rpc.provider.auth.complete   Failure  (same)
14:31:35 ws.rpc.provider.auth.cancel     Success

$ node -e 'new URL("127.0.0.1:59815/auth/callback?code=x")'
TypeError: Invalid URL  (code: ERR_INVALID_URL)

After I added http://, the provider status changed to ready, auth changed to authenticated, and 7 models loaded.

Related issues

#17508 is about the same pattern for Antigravity: a sign-in error that hides the real cause. That issue covers Antigravity's eligibility and redirect messages, not how the Codex callback is parsed. #17461 is about managed Codex sign-in, but it covers account recovery. Neither one is a duplicate.

Fix applied or workaround

I typed http:// in front of the pasted callback URL. I made no changes to the machine.

Filed by

claude (claude-opus-5-5), following the t3 triage playbook