openclaw - 💡(How to fix) Fix [Bug]: 2026.5.12 Codex harness fails fresh OpenAI Codex OAuth profile with 401 token_expired

Bug type

Behavior bug: Codex harness authentication path refreshes or validates a freshly logged-in OpenAI Codex OAuth profile and fails with token_expired.

Beta release blocker

No.

Summary

On 2026.5.12, every OpenClaw agent turn routed through the Codex harness fails with OpenAI Codex token refresh failed (401) token_expired, even after deleting the OpenClaw Codex auth profile, logging in again, and confirming models status reports the profile as healthy.

Steps to reproduce

1. Stop Gateway.
2. Remove the old OpenClaw openai-codex auth profile entries from:
   • ~/.openclaw/agents/main/agent/auth-profiles.json
   • ~/.openclaw/agents/main/agent/auth-state.json
   • ~/.openclaw/credentials/auth-profiles/<oauthRef>.json
3. Run openclaw models auth login --provider openai-codex.
4. Complete OAuth login for the OpenAI Codex account.
5. Confirm openclaw models status reports the profile as valid.
6. Restart Gateway.
7. Run:

openclaw agent --agent main --message 'Reply exactly: OK' --timeout 120

Expected behavior

The agent turn should run through the configured Codex harness runtime and return OK.

Actual behavior

The agent turn fails before model execution because the Codex harness reports a failed OpenAI Codex token refresh with 401 token_expired.

OpenClaw version

2026.5.12 (f066dd2)

Operating system

macOS 26.3.1

Install method

Source checkout with the live Gateway run by Homebrew Node 22 from the local built output. Main CLI is installed through pnpm.

Model

openai/gpt-5.5 with agentRuntime.id = codex

Standalone Codex CLI control also used gpt-5.5.

Provider / routing chain

openclaw agent -> Gateway -> openai/gpt-5.5 model ref -> Codex harness runtime -> openai-codex OAuth profile stored via OAuthRef.

Additional provider/model setup details

Relevant config shape:

agents.defaults.model.primary = openai/gpt-5.5
agents.defaults.models.openai/gpt-5.5.agentRuntime.id = codex
plugins.allow includes codex
plugins.bundledDiscovery = compat
plugins.entries.codex.enabled = true

openclaw models status after the fresh login:

Default       : openai/gpt-5.5
Configured models (1): openai/gpt-5.5
OAuth/token status
- openai-codex
  - openai-codex:<email> (<email>) ok expires in 10d

Sanitized auth profile shape:

key openai-codex:<email>
provider openai-codex
type oauth
email <email>
expires_iso 2026-05-24T22:04:31Z
hasInlineAccess false
hasInlineRefresh false
hasOauthRef true

No token material is included here.

Logs, screenshots, and evidence

CLI failure:

GatewayClientRequestError: FailoverError: OAuth token refresh failed for openai-codex:
OpenAI Codex token refresh failed (401): {
  "error": {
    "message": "Could not validate your token. Please try signing in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "token_expired"
  }
}

Gateway logs:

[gateway] agent model: openai/gpt-5.5 (thinking=medium, fast=off)
[ws] <-> res failed agent errorCode=UNAVAILABLE errorMessage=FailoverError:
OAuth token refresh failed for openai-codex: OpenAI Codex token refresh failed (401)
[agents/harness] Codex agent harness failed; not falling back to embedded PI backend
[diagnostic] lane task error: lane=main ... OAuth token refresh failed for openai-codex
[model-fallback/decision] model fallback decision: decision=candidate_failed
requested=openai/gpt-5.5 candidate=openai/gpt-5.5 reason=auth_permanent next=none
detail=OAuth token refresh failed for openai-codex ... code "token_expired"

Standalone Codex CLI works on the same machine and account:

codex login status
# Logged in using ChatGPT

codex exec -m gpt-5.5 -s read-only --skip-git-repo-check --ephemeral \
  'Reply exactly: OK'

Output:

codex
OK

Impact and severity

High for installs using the Codex harness runtime with OpenAI Codex OAuth. On this install, every agent turn fails, including Gmail hook-created agent sessions. The Gmail transport creates the sessions, but execution fails at the Codex auth path.

Additional information

openclaw doctor repair corrected a legacy openai-codex/gpt-5.5 route to openai/gpt-5.5 with agentRuntime.id = codex; the failure remained after the route repair and fresh OAuth login.

Related upstream reports appear to include OpenClaw issues #62247, #52037, #53466, and #57399. This report is specifically for 2026.5.12 with a fresh OAuthRef-backed profile that models status reports as valid.