Bug: Mixed Auth fails when publishing app (406 / 400 on /mcp)

[camargo1409]

Summary

When trying to publish an app on the OpenAI Platform using the Apps SDK with Mixed Auth, the publishing flow fails during the tool scanning step.
The platform sends a POST /mcp request which returns an error (406 in TypeScript, 400 in Python), preventing the publishing process from completing.

The issue only occurs with Mixed Auth. Using OAuth or No Auth works as expected.

Steps to Reproduce

• Create an app using this mixed auth example:
  https://github.com/openai/openai-apps-sdk-examples/tree/main/authenticated_server_python
• Configure the authorization server (Auth0) following the instructions
• Configure authentication mode as Mixed Auth on this screen:

• Attempt to publish the app on the OpenAI Platform
• During the publishing flow, the platform attempts to scan tools
• The platform sends a POST request to /mcp
• The request fails and publishing cannot continue

Actual Behavior

TypeScript

• POST /mcp returns 406 Not Acceptable

Python

• POST /mcp returns 400 Bad Request
• Warning/error message:
  Invalid Content-type: text/octet-stream

Expected Behavior

When using Mixed Auth, the platform should successfully call /mcp, scan the tools, and allow the publishing process to proceed, same as with OAuth or No Auth.

Additional Context

This error blocks the tool scanning step, making it impossible to publish apps that require Mixed Auth.