Codex MCP login times out in an SSH shell after browser sign-in

Symptom. The provider reports successful sign-in on the laptop, but the remote Codex CLI waits and eventually reports timed out waiting for OAuth callback. The browser’s localhost callback may show connection refused.

Root cause. Codex’s callback listener is on the workstation. The laptop browser reaches its own loopback interface unless the same port is forwarded over SSH. ForwardAgent yes forwards SSH signing access; it does not deliver an HTTP callback. By default the MCP callback port changes between logins.

Confirm. Read the callback host and port from the login URL’s redirect_uri parameter. While login is waiting, compare ss -ltnp on the workstation with lsof -nP -iTCP:<port> -sTCP:LISTEN on the laptop. Keep callback query strings out of shared logs: they contain authorization codes and state.

Fix. Configure a host-specific DF_CODEX_MCP_CALLBACK_PORT and matching loopback-only LocalForward, then retry a fresh login. If sign-in already completed while the CLI is still waiting, establish the matching tunnel and use the provider’s Finish OAuth button. See MCP login from SSH for commands, concurrent-host behavior, and existing SSH connection handling.