OAuth client_id becomes invalid after server restart due to in-memory client store

[YUGOOD515]

Description

Environment: Windows 11 stable latest (26200.8655), PowerShell

When using DevSpace MCP with ChatGPT through a Cloudflare tunnel, the MCP works normally while the Node.js process keeps running. Disconnecting and reconnecting from ChatGPT does not break the connection.

However, after stopping the local server with Ctrl+C and starting it again with npm run start, ChatGPT can no longer reconnect. The OAuth page returns:

{"error":"invalid_client","error_description":"Invalid client_id"}

Steps to Reproduce

1. Start DevSpace with npm run start.

2. Add the MCP in ChatGPT and authenticate with the owner password.

3. Use the MCP to read local files successfully.

4. Disconnect and reconnect in ChatGPT; it still works.

5. Stop the local DevSpace process with Ctrl+C.

6. Run npm run start again.

7. Try reconnecting from ChatGPT.

8. The OAuth flow fails with invalid_client.

Expected Behavior

After restarting the DevSpace server, an existing ChatGPT MCP connection should either reconnect successfully, or the server should handle re-registration cleanly.

Actual Behavior

The server rejects the existing ChatGPT OAuth client with:

JSON

{"error":"invalid_client","error_description":"Invalid client_id"}

Possible Cause

From the source code, it looks like OAuth clients are stored in an in-memory Map. After the Node.js process restarts, the registered client_id is lost, while ChatGPT still tries to use the previously registered client_id.

This seems to make the OAuth client registration non-persistent across server restarts.

I would be happy to help with a PR if the maintainers agree this should be fixed by persisting registered OAuth clients. I am not very familiar with the whole codebase, so I would appreciate guidance on the preferred storage location and expected behavior.

[YUGOOD515]

I made a local change to persist OAuth registered clients to:

~/.devspace/oauth-clients.json

After this change, restarting DevSpace no longer invalidates the existing ChatGPT MCP connection in my tests.

Tested flow:

Connect successfully → Ctrl+C → npm run start → reconnect from ChatGPT

I repeated this several times, and the MCP connection remained stable.

So at least for my local setup, persisting OAuth registered clients across server restarts seems to resolve the issue.

[Waishnav]

Fix is already ready locally, will be shipping tomorrow

[aaamosh]

Great project, by the way. We're testing it now as a ChatGPT Developer Mode -> local coding workspace bridge on Linux, and the core idea is very interesting.

I can confirm this issue with a real ChatGPT web setup behind Tailscale Funnel on @waishnav/devspace@1.0.1:

• ChatGPT registered a dynamic OAuth client and connected successfully.
• After restarting the DevSpace process, ChatGPT reused the cached client_id.
• DevSpace returned invalid_client because the OAuth client registry had been only in memory.
• A local workaround that persisted registered OAuth clients to ~/.devspace/oauth-clients.json fixed it for us.
• With that workaround in place, ChatGPT completed OAuth after restart, OpenAI created openai-mcp/1.0.0 MCP sessions, and DevSpace successfully handled open_workspace, read, and bash tool calls.

For the local workaround we also kept the file mode at 0600, since it effectively becomes trusted OAuth client metadata for this local bridge.

I saw your note that you already have a fix ready locally, so no duplicate PR from us right now. Just leaving this as another confirmation from a Tailscale Funnel + ChatGPT web route. Thanks for building this; it is genuinely useful.