ChatGPT/Codex Vercel connector: empty teams and 403 after reconnect — private follow-up requested - Help

Hello Vercel team,

The installed Vercel connector in ChatGPT/Codex authenticates successfully, but cannot read my team-owned project. I can access the team and project normally in the Vercel dashboard.

Observed on 17 October 2026:

The authenticated-user lookup succeeds and reports the expected account and default team.
list_teams returns an empty list.
Team, project and production-deployment reads return HTTP 403 forbidden, even when the correct explicit teamId is supplied.
The error says the connector is not authorized for the requested team scope.
Responses report saml: false and ssoEnforced: false.
Reconnecting repeatedly and testing in a fresh chat have not restored access.

The Vercel support assistant suggested a personal-versus-team token scope issue, but the actual OAuth grant has not been independently verified. The support case form directs Vercel MCP beta issues to Community, so no human case number was issued.

Could a Vercel staff member please arrange private follow-up to inspect the connector's effective authorization and determine whether the team grant is being persisted and applied correctly? I can provide account details and request IDs privately through an official secure channel; they are intentionally omitted here. Please advise how to share them securely.

This request is limited to repairing the connector's team read access. Please do not alter the website, live data, deployments, domains, project settings, publishing jobs or schedules, or credentials used by publishing jobs. Do not trigger deployments or publishing runs or revoke unrelated tokens.

Thank you.

This looks like the same failure as the thread posted a few hours earlier today: https://community.vercel.com/t/50929

Vercel Community

Connect, learn, share projects, and get community support

Short version: this is the team-scope problem, not the client-approval one, and reconnecting cannot resolve it. There is no team scope in the OAuth layer at all. The protected resource advertises scopes_supported: ["openid"] and the authorization server advertises openid, email, profile, offline_access, so "not authorized for the requested team scope" cannot be naming an OAuth scope, and repeating consent reproduces the same grant binding.

Reported on Hobby and Pro, so not a plan limit. Calls that omit teamId still work meanwhile.

Full write-up with the discovery output: https://community.vercel.com/t/two-different-403s-client-approval-and-team-scope-are-separate-problems/50539