openclaw - 💡(How to fix) Fix Bug: Codex OAuth image generation fails with api.responses.write scope error on 2026.5.7; gpt-5.5-pro rejected as unsupported for ChatGPT accounts

Bug type

Bug (auth / provider routing)

Summary

On OpenClaw 2026.5.7 (stable), image_generate with openai/gpt-image-2 fails with HTTP 401 Missing scopes: api.responses.write when only a Codex OAuth profile is available (no OPENAI_API_KEY). Separately, the fallback chain includes openai-codex/gpt-5.5-pro, which the Codex backend rejects as unsupported for ChatGPT accounts.

The upstream docs/providers/openai.md on main documents that openai/gpt-image-2 should work with either OPENAI_API_KEY or Codex OAuth, but the installed stable release does not successfully route image generation through the Codex Responses transport.

Environment

• OS: Arch Linux (Samsung Chromebox XE300M22, headless)
• OpenClaw: 2026.5.7 (eeef486)
• Auth route: openai-codex:[email protected] OAuth profile (ChatGPT Plus subscription)
• No OPENAI_API_KEY set
• Provider config: openai plugin in plugins.allow, no separate codex plugin entry
• Default model: openai-codex/gpt-5.5 (PI route, as configured by openclaw doctor)
• Image model: openai/gpt-image-2 (primary), with openrouter/openai/gpt-5.4-image-2 and minimax/image-01 fallbacks
• Node: v25.9.0

Reproduction

Issue 1: Codex OAuth image generation 401

# From an OpenClaw session or CLI:
image_generate model=openai/gpt-image-2 prompt="A red square on white background"

Actual result:

OpenAI Codex image generation failed (HTTP 401): You have insufficient permissions
for this operation. Missing scopes: api.responses.write. Check that you have the
correct role in your organization (Reader, Writer, Owner) and project (Member, Owner),
and if you're using a ChatGPT subscription, verify that the model supports this action.
[type=invalid_request_error]

The OAuth profile is valid and recently refreshed (expires 2026-05-22). Agent/chat turns through openai-codex/gpt-5.5 PI route work normally. Only image generation fails.

Expected result:

Image generation succeeds through the Codex OAuth profile, as documented in docs/providers/openai.md on main:

Image generation or editing | openai/gpt-image-2 | Works with either OPENAI_API_KEY or OpenAI Codex OAuth.

Issue 2: gpt-5.5-pro rejected for ChatGPT accounts

When the model fallback chain reaches openai-codex/gpt-5.5-pro:

LLM request rejected: The 'gpt-5.5-pro' model is not supported when using Codex
with a ChatGPT account.

This model is not available on ChatGPT Plus subscriptions, but it appears in the fallback chain because openclaw doctor preserved it from the original Codex OAuth route configuration.

Expected result:

OpenClaw should either skip gpt-5.5-pro when the Codex backend signals it is unsupported, or not include it in the default fallback chain for ChatGPT-subscription auth profiles.

Version gap analysis

The upstream docs/providers/openai.md on main has been significantly rewritten to describe:

1. openai/* as the canonical model route (replacing openai-codex/*)
2. A bundled codex plugin for native Codex app-server runtime
3. Codex OAuth image generation through the Responses backend

However, the following relevant commits landed after the v2026.5.7 stable tag:

The latest stable is v2026.5.7 (eeef486). The next available tag is v2026.5.12-beta.1 (1824464b).

This suggests the Codex OAuth image generation support described in the docs may require one of these post-5.7 commits, but operators on the stable channel see docs that describe functionality not yet available in their installed version.

Related issues

• #38706 — Original api.responses.write scope issue for GPT-5.4 chat/agent turns. Our issue extends this to the image generation path on 2026.5.7.
• #76690 — openai/gpt-image-2 via Codex OAuth fails with image_generation tool not found (HTTP 400, different error but same root area). Filed on 2026.5.2 / Windows. Our error is HTTP 401 with explicit scope missing.
• #72087 — dist/entry.js main-path breaks Codex OAuth image generation on Linux while direct runCli() succeeds. Different root cause (entry bootstrap) but overlapping symptom space.
• #79726 — refactor: use PI Codex Responses transport. May be the fix for image generation scope routing, but landed after stable 5.7.

Open questions

1. Is Codex OAuth image generation expected to work on stable v2026.5.7, or does it require upgrading to the post-5.7 commits / v2026.5.12-beta.1?
2. Should the fallback chain automatically exclude gpt-5.5-pro for ChatGPT-subscription profiles?
3. Should openclaw doctor --fix remove unsupported models from the fallback chain when the backend signals rejection?

Suggested fixes

• If image generation through Codex OAuth requires post-5.7 code, the stable docs should note the minimum version requirement, or the docs on main should be backported to match what stable actually supports.
• The model fallback chain should gracefully handle "model not supported for this account" rejections without surfacing them as runtime errors to the user.

Reported-by: Lance (ShapeShifter499) Assisted-by: OpenClaw:zai/glm-5.1 (issue investigation and drafting)