Hosted Account Experience COOP header breaks OAuth popup clients #451

Open
Open
Hosted Account Experience COOP header breaks OAuth popup clients#451
Labels
bugSomething is not working.

Description

@getlarge
getlarge
opened on Sep 1, 2026

Preflight checklist

Ory Network Project

https://tender-satoshi-rtd7nibdhq.projects.oryapis.com

Describe the bug

OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.

As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:

MCP authorization failed: OAuth flow canceled.

The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….

The hosted response contains:

Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T

That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.

When continuing the login manually, the hosted Account Experience has also displayed:

This page couldn't load
Reload to try again, or go back.

with this browser console error:

TypeError: null is not an object (evaluating 't.reason.enqueueModel')

Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.

Reproducing the bug

  1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
  2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
  3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
  4. Select Authorize MCP → Continue.
  5. OpenAI opens the authorization flow in a popup.
  6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
  7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
  8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.

Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.

Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.

Relevant log output

OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.

Relevant configuration

Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none

Version

Ory Network hosted Account Experience, current on 2026-09-01

On which operating system are you observing this issue?

macOS

In which environment are you deploying?

Ory Network

Additional Context

The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.

Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.

The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething is not working.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
       blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

      Skip to content
      Hosted Account Experience COOP header breaks OAuth popup clients #451
      Open
      Open
      Hosted Account Experience COOP header breaks OAuth popup clients#451
      Labels
      bugSomething is not working.
      Description
      @getlarge
      getlarge
      opened on Sep 1, 2026
      Preflight checklist
      Ory Network Project
      https://tender-satoshi-rtd7nibdhq.projects.oryapis.com
      Describe the bug
      OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.
      As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:
      MCP authorization failed: OAuth flow canceled.

      The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….
      The hosted response contains:
      Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T
      That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.
      When continuing the login manually, the hosted Account Experience has also displayed:
      This page couldn't load
Reload to try again, or go back.

      with this browser console error:
      TypeError: null is not an object (evaluating 't.reason.enqueueModel')

      Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.
      Reproducing the bug
      1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
      2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
      3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
      4. Select Authorize MCP → Continue.
      5. OpenAI opens the authorization flow in a popup.
      6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
      7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
      8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.
      Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.
      Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.
      Relevant log output
      OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.
      Relevant configuration
      Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
      Version
      Ory Network hosted Account Experience, current on 2026-09-01
      On which operating system are you observing this issue?
      macOS
      In which environment are you deploying?
      Ory Network
      Additional Context
      The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.
      Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.
      The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.
      Metadata
      Metadata
      Assignees
      No one assigned
        Labels
        bugSomething is not working.
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

          Skip to content
          Hosted Account Experience COOP header breaks OAuth popup clients #451
          Open
          Open
          Hosted Account Experience COOP header breaks OAuth popup clients#451
          Labels
          bugSomething is not working.
          Description
          @getlarge
          getlarge
          opened on Sep 1, 2026
          Preflight checklist
          Ory Network Project
          https://tender-satoshi-rtd7nibdhq.projects.oryapis.com
          Describe the bug
          OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.
          As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:
          MCP authorization failed: OAuth flow canceled.

          The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….
          The hosted response contains:
          Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T
          That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.
          When continuing the login manually, the hosted Account Experience has also displayed:
          This page couldn't load
Reload to try again, or go back.

          with this browser console error:
          TypeError: null is not an object (evaluating 't.reason.enqueueModel')

          Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.
          Reproducing the bug
          1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
          2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
          3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
          4. Select Authorize MCP → Continue.
          5. OpenAI opens the authorization flow in a popup.
          6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
          7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
          8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.
          Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.
          Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.
          Relevant log output
          OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.
          Relevant configuration
          Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
          Version
          Ory Network hosted Account Experience, current on 2026-09-01
          On which operating system are you observing this issue?
          macOS
          In which environment are you deploying?
          Ory Network
          Additional Context
          The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.
          Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.
          The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.
          Metadata
          Metadata
          Assignees
          No one assigned
            Labels
            bugSomething is not working.
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              Hosted Account Experience COOP header breaks OAuth popup clients #451
              Open
              Open
              Hosted Account Experience COOP header breaks OAuth popup clients#451
              Labels
              bugSomething is not working.
              Description
              @getlarge
              getlarge
              opened on Sep 1, 2026
              Preflight checklist
              Ory Network Project
              https://tender-satoshi-rtd7nibdhq.projects.oryapis.com
              Describe the bug
              OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.
              As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:
              MCP authorization failed: OAuth flow canceled.

              The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….
              The hosted response contains:
              Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T
              That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.
              When continuing the login manually, the hosted Account Experience has also displayed:
              This page couldn't load
Reload to try again, or go back.

              with this browser console error:
              TypeError: null is not an object (evaluating 't.reason.enqueueModel')

              Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.
              Reproducing the bug
              1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
              2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
              3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
              4. Select Authorize MCP → Continue.
              5. OpenAI opens the authorization flow in a popup.
              6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
              7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
              8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.
              Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.
              Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.
              Relevant log output
              OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.
              Relevant configuration
              Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
              Version
              Ory Network hosted Account Experience, current on 2026-09-01
              On which operating system are you observing this issue?
              macOS
              In which environment are you deploying?
              Ory Network
              Additional Context
              The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.
              Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.
              The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.
              Metadata
              Metadata
              Assignees
              No one assigned
                Labels
                bugSomething is not working.
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions
                  
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

                  Skip to content
                  Hosted Account Experience COOP header breaks OAuth popup clients #451
                  Open
                  Open
                  Hosted Account Experience COOP header breaks OAuth popup clients#451
                  Labels
                  bugSomething is not working.
                  Description
                  @getlarge
                  getlarge
                  opened on Sep 1, 2026
                  Preflight checklist
                  Ory Network Project
                  https://tender-satoshi-rtd7nibdhq.projects.oryapis.com
                  Describe the bug
                  OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.
                  As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:
                  MCP authorization failed: OAuth flow canceled.

                  The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….
                  The hosted response contains:
                  Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T
                  That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.
                  When continuing the login manually, the hosted Account Experience has also displayed:
                  This page couldn't load
Reload to try again, or go back.

                  with this browser console error:
                  TypeError: null is not an object (evaluating 't.reason.enqueueModel')

                  Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.
                  Reproducing the bug
                  1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
                  2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
                  3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
                  4. Select Authorize MCP → Continue.
                  5. OpenAI opens the authorization flow in a popup.
                  6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
                  7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
                  8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.
                  Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.
                  Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.
                  Relevant log output
                  OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.
                  Relevant configuration
                  Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
                  Version
                  Ory Network hosted Account Experience, current on 2026-09-01
                  On which operating system are you observing this issue?
                  macOS
                  In which environment are you deploying?
                  Ory Network
                  Additional Context
                  The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.
                  Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.
                  The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.
                  Metadata
                  Metadata
                  Assignees
                  No one assigned
                    Labels
                    bugSomething is not working.
                    Type
                    No type
                    Projects
                    No projects
                      Milestone
                      No milestone
                      Relationships
                      None yet
                      Development
                      No branches or pull requests
                      Issue actions
                      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                      Skip to content
                      Hosted Account Experience COOP header breaks OAuth popup clients #451
                      Open
                      Open
                      Hosted Account Experience COOP header breaks OAuth popup clients#451
                      Labels
                      bugSomething is not working.
                      Description
                      @getlarge
                      getlarge
                      opened on Sep 1, 2026
                      Preflight checklist
                      Ory Network Project
                      https://tender-satoshi-rtd7nibdhq.projects.oryapis.com
                      Describe the bug
                      OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.
                      As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:
                      MCP authorization failed: OAuth flow canceled.

                      The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….
                      The hosted response contains:
                      Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T
                      That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.
                      When continuing the login manually, the hosted Account Experience has also displayed:
                      This page couldn't load
Reload to try again, or go back.

                      with this browser console error:
                      TypeError: null is not an object (evaluating 't.reason.enqueueModel')

                      Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.
                      Reproducing the bug
                      1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
                      2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
                      3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
                      4. Select Authorize MCP → Continue.
                      5. OpenAI opens the authorization flow in a popup.
                      6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
                      7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
                      8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.
                      Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.
                      Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.
                      Relevant log output
                      OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.
                      Relevant configuration
                      Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
                      Version
                      Ory Network hosted Account Experience, current on 2026-09-01
                      On which operating system are you observing this issue?
                      macOS
                      In which environment are you deploying?
                      Ory Network
                      Additional Context
                      The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.
                      Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.
                      The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.
                      Metadata
                      Metadata
                      Assignees
                      No one assigned
                        Labels
                        bugSomething is not working.
                        Type
                        No type
                        Projects
                        No projects
                          Milestone
                          No milestone
                          Relationships
                          None yet
                          Development
                          No branches or pull requests
                          Issue actions
                          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                          Skip to content
                          Hosted Account Experience COOP header breaks OAuth popup clients #451
                          Open
                          Open
                          Hosted Account Experience COOP header breaks OAuth popup clients#451
                          Labels
                          bugSomething is not working.
                          Description
                          @getlarge
                          getlarge
                          opened on Sep 1, 2026
                          Preflight checklist
                          Ory Network Project
                          https://tender-satoshi-rtd7nibdhq.projects.oryapis.com
                          Describe the bug
                          OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.
                          As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:
                          MCP authorization failed: OAuth flow canceled.

                          The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….
                          The hosted response contains:
                          Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T
                          That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.
                          When continuing the login manually, the hosted Account Experience has also displayed:
                          This page couldn't load
Reload to try again, or go back.

                          with this browser console error:
                          TypeError: null is not an object (evaluating 't.reason.enqueueModel')

                          Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.
                          Reproducing the bug
                          1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
                          2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
                          3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
                          4. Select Authorize MCP → Continue.
                          5. OpenAI opens the authorization flow in a popup.
                          6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
                          7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
                          8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.
                          Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.
                          Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.
                          Relevant log output
                          OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.
                          Relevant configuration
                          Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
                          Version
                          Ory Network hosted Account Experience, current on 2026-09-01
                          On which operating system are you observing this issue?
                          macOS
                          In which environment are you deploying?
                          Ory Network
                          Additional Context
                          The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.
                          Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.
                          The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.
                          Metadata
                          Metadata
                          Assignees
                          No one assigned
                            Labels
                            bugSomething is not working.
                            Type
                            No type
                            Projects
                            No projects
                              Milestone
                              No milestone
                              Relationships
                              None yet
                              Development
                              No branches or pull requests
                              Issue actions
                              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                              Skip to content
                              Hosted Account Experience COOP header breaks OAuth popup clients #451
                              Open
                              Open
                              Hosted Account Experience COOP header breaks OAuth popup clients#451
                              Labels
                              bugSomething is not working.
                              Description
                              @getlarge
                              getlarge
                              opened on Sep 1, 2026
                              Preflight checklist
                              Ory Network Project
                              https://tender-satoshi-rtd7nibdhq.projects.oryapis.com
                              Describe the bug
                              OpenAI's public plugin-submission flow requires an MCP tool scan before a plugin can be submitted for review. The scanner successfully discovers our MCP protected-resource metadata, then starts OAuth authorization in a popup.
                              As soon as the popup navigates to Ory Network's hosted Account Experience, the OpenAI parent page reports:
                              MCP authorization failed: OAuth flow canceled.

                              The popup was not canceled or closed. It remains open on Ory's "Reauthenticate" page at https://auth.themolt.net/login?flow=….
                              The hosted response contains:
                              Cross-Origin-Opener-Policy: same-originOry-Network-Ingress: T
                              That COOP policy separates the cross-origin popup into another browsing-context group and severs its opener relationship. OpenAI consequently observes the popup as closed/canceled. No authenticated MCP tools/list request occurs, so the mandatory scan remains incomplete and submission is blocked.
                              When continuing the login manually, the hosted Account Experience has also displayed:
                              This page couldn't load
Reload to try again, or go back.

                              with this browser console error:
                              TypeError: null is not an object (evaluating 't.reason.enqueueModel')

                              Could Ory change OAuth login/consent pages to Cross-Origin-Opener-Policy: same-origin-allow-popups, expose a project-level setting for this header, or document another supported configuration for OAuth popup clients? Please also investigate the hosted UI crash.
                              Reproducing the bug
                              1. Configure an MCP server protected by Ory Network OAuth2/OIDC and dynamic client registration.
                              2. In OpenAI's public plugin-submission portal, provide the MCP URL and select Scan Tools. This scan is mandatory before Submit for Review is enabled.
                              3. OpenAI successfully requests GET /.well-known/oauth-protected-resource/mcp and determines OAuth is required.
                              4. Select Authorize MCP → Continue.
                              5. OpenAI opens the authorization flow in a popup.
                              6. The popup navigates to https://auth.themolt.net/login?flow=… and shows Ory's Reauthenticate UI.
                              7. The parent OpenAI page immediately reports MCP authorization failed: OAuth flow canceled., while the popup remains open.
                              8. If login is continued manually, the Ory-hosted page may instead render This page couldn't load with the t.reason.enqueueModel error.
                              Expected: the popup remains connected to its opener, completes authorization, returns to OpenAI's callback, and allows the MCP tool scan to call tools/list.
                              Actual: the opener relationship is severed on navigation to the hosted Account Experience, OpenAI treats OAuth as canceled, and the required scan cannot run.
                              Relevant log output
                              OpenAI parent page:
MCP authorization failed: OAuth flow canceled.
Ory Account Experience error:
This page couldn't loadReload to try again, or go back.Browser console:TypeError: null is not an object (evaluating 't.reason.enqueueModel')Observed response headers from curl -I https://auth.themolt.net/login:cross-origin-opener-policy: same-originory-network-ingress: TMCP-side sequence:POST /mcp -> 415 initial scanner probeGET /.well-known/oauth-protected-resource/mcp -> 200No authenticated /mcp request follows.
                              Relevant configuration
                              Ory Network project:
https://tender-satoshi-rtd7nibdhq.projects.oryapis.comCustom domain:
https://auth.themolt.netDNS (OVH, direct CNAME; no customer-controlled proxy):
auth.themolt.net CNAME tender-satoshi-rtd7nibdhq.projects.oryapis.comMCP server:
https://mcp.themolt.net/mcpOAuth client:
- dynamic client registration
- authorization_code and refresh_token grants
- PKCE-compatible public client
- ChatGPT callback redirect URI
- token_endpoint_auth_method: none
                              Version
                              Ory Network hosted Account Experience, current on 2026-09-01
                              On which operating system are you observing this issue?
                              macOS
                              In which environment are you deploying?
                              Ory Network
                              Additional Context
                              The same MCP server and Ory authorization flow work through the normal ChatGPT connector. Discovery, dynamic registration, redirect URI registration, PKCE, and the authorization-code grant configuration are working. The failure is specific to OpenAI's mandatory plugin-submission scanner, which monitors a popup lifecycle.
                              Related but distinct: ory/elements#587 reports a hosted consent redirect failure. This report concerns the hosted Account Experience/Network response header severing an OAuth popup, plus the separate t.reason.enqueueModel runtime failure.
                              The issue was drafted with Codex from captured browser, HTTP-header, OAuth-client, and server-log evidence.
                              Metadata
                              Metadata
                              Assignees
                              No one assigned
                                Labels
                                bugSomething is not working.
                                Type
                                No type
                                Projects
                                No projects
                                  Milestone
                                  No milestone
                                  Relationships
                                  None yet
                                  Development
                                  No branches or pull requests
                                  Issue actions