Lovable MCP OAuth discovery fails before browser: missing protected resource field

[theo847]

Summary

Codex Desktop and its bundled CLI cannot authenticate to Lovable's official Streamable HTTP MCP server. The OAuth flow fails before a browser or authorization URL is opened.

Environment

• Codex Desktop: 26.825.3734.0
• Bundled CLI: codex-cli 0.150.0-alpha.12.2 (Windows ARM64)
• OS: Windows 11
• MCP server URL: https://mcp.lovable.dev
• Configuration: project-scoped .codex/config.toml, auth = "oauth", server enabled

Expected behavior

codex mcp login lovable should start the OAuth browser flow and store credentials, as documented for OAuth-capable remote MCP servers.

Actual behavior

The command exits before opening a browser:

Error: Metadata error: Protected resource metadata missing required resource field

The same result occurs with the default registration strategy and with both explicit alternatives:

codex mcp login lovable
codex mcp login lovable --oauth-client-registration dcr
codex mcp login lovable --oauth-client-registration cimd

The Codex Desktop MCP UI lists the server as enabled but its controls/tools remain unavailable. Desktop logs mark startup as failed because the server is not logged in.

Independent endpoint checks

Unauthenticated checks of the public server return the expected OAuth discovery data:

• POST https://mcp.lovable.dev with an MCP initialize request returns 401 Unauthorized and:

  WWW-Authenticate: Bearer realm="mcp", resource_metadata="https://mcp.lovable.dev/.well-known/oauth-protected-resource"
  

• GET https://mcp.lovable.dev/.well-known/oauth-protected-resource returns JSON containing:

  {
    "resource": "https://mcp.lovable.dev",
    "authorization_servers": ["https://lovable.dev/oauth"]
  }

Adding oauth_resource = "https://mcp.lovable.dev" to the MCP configuration did not change the error.

Reproduction

1. Configure the Lovable endpoint as an enabled streamable HTTP MCP server with OAuth.
2. Run codex mcp login lovable.
3. Observe the metadata error before any browser login begins.

No credentials, user identifiers, project identifiers, or private logs are included in this report.

[theo847]

Update from Lovable's current settings UI:

Lovable now recommends the endpoint https://mcp.lovable.dev/?src=settings for supported clients. Codex documentation notes that query parameters contribute to the OAuth callback identity, so I retried using that exact URL with forced DCR:

codex -c 'mcp_servers.lovable.url="https://mcp.lovable.dev/?src=settings"' \
  mcp login lovable --oauth-client-registration dcr

Result: the same failure occurs before a browser opens:

Error: Metadata error: Protected resource metadata missing required resource field

The recommended URL's unauthenticated MCP initialize response still returns the same valid 401 challenge and protected-resource metadata URL. This suggests the ?src=settings parameter is not sufficient to resolve the Codex-side discovery failure.

[theo847]

Update from Lovable support, based on a current production-side check:

• The protected-resource metadata does include the required resource value, so the observed error is not caused by an incomplete metadata document.
• Lovable currently accepts OAuth client registrations only from a fixed set of supported MCP clients. Codex is not yet enabled for mcp.lovable.dev in production.
• The rejection occurs during client registration, before the browser flow starts, matching the behavior reported here. This suggests the CLI error may be misattributing a registration/client-allowlist rejection as a missing protected-resource field.
• Lovable says its public Codex instructions are ahead of current production support and are being corrected.

Codex's current MCP documentation supports a pre-registered OAuth client ID, but Lovable has not provided an OAuth client registration that is accepted for Codex. Therefore there is no supported local configuration workaround at present.

This issue may be most useful as an error-reporting/diagnostic issue: surface a registration rejection or unsupported client more accurately than “Protected resource metadata missing required resource field.”