docs: [SDK-5445] name the Codex MCP sign-in steps next to the Claude Code ones

[sherwinski]

One Line Summary

The credentials and verify skills now give the Codex MCP sign-in steps next to the Claude Code ones, and the README says which Codex install path registers the MCP server.

Motivation

We are looking to compare the MCP authentication experience in Codex and in Claude Code. The skills told every user to run /mcp → onesignal → Authenticate, which is a Claude Code command. A Codex user has no /mcp command and gets no usable instruction at the "No key and no MCP" gate.

What I checked on Codex 0.161.0, from a clean CODEX_HOME and a local marketplace:

Install path	MCP server after install	Sign-in step
Claude Code (.mcp.json in the plugin)	registered, needs authentication	/mcp → onesignal → Authenticate
Codex, GitHub marketplace (repository tree)	codex mcp list shows onesignal … Not logged in	none today: Codex's own sign-in fails against this server (see below), so the text routes to the connector or the app API key path
Codex, OpenAI directory listing	the listing attaches the OneSignal connector (.app.json, asdk_app_6a3d…, required: true); codex mcp list shows no onesignal server	sign in where Codex asks to connect the connector (the only Codex path that works today)

The directory bundle cannot ship .mcp.json: the Skills upload rejects MCP configuration (see AGENT.md, "The OpenAI directory bundle"). The live listing attaches the OneSignal ChatGPT app (asdk_app_6a3d…, required: true) through a portal-generated .app.json instead. The bug bash screenshots confirm that a Codex app session from the directory install had the tools through that connector (the agent offered to upload "through the OneSignal connector"). I did not test the connector's sign-in prompt myself; my clean-CODEX_HOME bundle install had no .app.json, which is why codex mcp list was empty there. The README describes the connector and keeps the add-by-hand commands as the fallback for a session with no OneSignal tools.

Codex's own OAuth client rejects the OneSignal server. Reproduced in a scratch CODEX_HOME:

$ codex mcp add onesignal --url https://api.onesignal.com/mcp/oauth
Added global MCP server 'onesignal'.
Detected OAuth support. Starting OAuth flow…
Error: OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks
$ codex mcp login onesignal
Error: OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

https://api.onesignal.com/.well-known/oauth-authorization-server has issuer: https://api.onesignal.com and authorization_endpoint: https://dashboard.onesignal.com/oauth/authorize, and no authorization_response_iss_parameter_supported. Codex's rmcp-client/src/oauth/issuer_binding.rs rejects that combination (RFC 9207). Same class as openai/codex#41677 and #41362. The fix is server-side: advertise authorization_response_iss_parameter_supported: true and return iss on the callback, or serve the authorize endpoint on api.onesignal.com. Until then the README and the skills do not name codex mcp login or codex mcp add at all. They say: connector from the directory install, else the app API key. Server-side fix: SDK-5460 (auth-service, services/auth-http).

Ticket: SDK-5445

Scope

• skills/credentials/SKILL.md: the "No key and no MCP" ladder names the Codex check (codex mcp list) and the Codex sign-in step next to the Claude Code ones.
• skills/verify/SKILL.md: the same change in the "Tools absent" step.
• README.md, "Install in Codex → After install": Option A gets the tools through the OneSignal connector. Option B registers the server from .mcp.json, but Codex's sign-in fails against it with the error above, so the section says Codex's own sign-in does not work against it yet and names the 2 ways forward (Option A, or ONESIGNAL_REST_API_KEY).

Not changed: the packager, the manifests, the version (1.1.1 is already past the 1.1.0 release).

Testing

• python3 scripts/package_directory_bundle.py --check: passes
• Portability grep on skills/ and references/: no output
• Codex smoke, clean CODEX_HOME: installed the repository tree and the --out bundle through local marketplaces; codex mcp list output as in the table above; codex debug prompt-input lists onesignal:setup, onesignal:credentials, and onesignal:verify for both.
• codex mcp add and codex mcp login onesignal in a scratch CODEX_HOME: both fail with the RFC 9207 error above before a browser opens.

Not verified: a full skill run in Codex that reaches the "No key and no MCP" gate. The behavior evals did not run.

Affected code

• Skills
• References
• Runtime scripts
• Development tooling
• Documentation (README.md)
• Manifests

Checklist

• Commit subjects use a conventional prefix
• No secrets or internal ticket IDs in skills, scripts, or references
• Local checks 1 to 4 from AGENT.md pass
• Behavior evals: credentials_android_fcm and verify_gate still to run before merge

[sherwinski]

Dogfood run on Oct 9 (local marketplace install of the stack branch, credentials skill in Codex) still ran codex mcp login onesignal with the previous wording, hit the origin error, and then asked an open question. a9270b6 changes the approach: the rule is now an instruction before the options ("In Codex, do not run codex mcp login or codex mcp add"), the "codex mcp list shows Not logged in" cue is gone from both skills, and a Codex agent without the connector asks the structured question with options 2 and 3 only. The README says the same. .codex-plugin/plugin.json still registers the server through .mcp.json; removing that until SDK-5460 ships is a separate decision.

[kalley]

Clear write-up of the Codex OAuth failure, and the "don't run login" rule reads well in both skills. One non-blocking note inline. The Scope section still says the ladder names codex mcp list, but a9270b6 removed that.

[abdulraqeeb33]

Looks good. Credentials and verify agree on the Codex path: no codex mcp login, the connector when its tools are present, otherwise the key or dashboard options. Heads-up: #60 will conflict with this in the README Codex section; the resolution should keep this bullet.