hermes - 💡(How to fix) Fix [Bug]: OpenAI Codex OAuth requests fail with 401 for residency-enforced workspaces

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Error Message

AuthenticationError [HTTP 401]
Provider: openai-codex  Model: gpt-5.5
Endpoint: https://chatgpt.com/backend-api/codex
Error: HTTP 401: Workspace is not authorized in this region.

Root Cause

Root Cause Analysis (optional)

Fix Action

Fix / Workaround

Example patch shape:

Example patch shape:

Code Example

HTTP 401: Workspace is not authorized in this region.

---

x-openai-internal-codex-residency: <residency>

---

residency = (
    auth_claims.get("chatgpt_data_residency")
    or auth_claims.get("chatgpt_compute_residency")
)
if isinstance(residency, str) and residency.strip():
    headers["x-openai-internal-codex-residency"] = residency.strip()

---

AuthenticationError [HTTP 401]
Provider: openai-codex  Model: gpt-5.5
Endpoint: https://chatgpt.com/backend-api/codex
Error: HTTP 401: Workspace is not authorized in this region.

---

--- hermes dump ---
version:          0.13.0 (2026.5.7) [64145a19]
os:               Linux 6.17.0-1014-nvidia aarch64
python:           3.11.15
openai_sdk:       2.31.0
profile:          default
hermes_home:      ~/.hermes
model:            gpt-5.5
provider:         openai-codex
terminal:         local

api_keys:
  openrouter           not set
  openai               not set
  anthropic            not set
  anthropic_token      not set
  nous                 not set
  google/gemini        not set
  gemini               not set
  glm/zai              not set
  zai                  not set
  kimi                 not set
  minimax              not set
  deepseek             not set
  dashscope            not set
  huggingface          not set
  nvidia               not set
  ai_gateway           not set
  opencode_zen         not set
  opencode_go          not set
  kilocode             not set
  firecrawl            not set
  tavily               set
  browserbase          not set
  fal                  not set
  elevenlabs           not set
  github               not set

features:
  toolsets:           hermes-cli
  mcp_servers:        0
  memory_provider:    built-in
  gateway:            running (systemd (user), pid 114864)
  platforms:          telegram, whatsapp
  cron_jobs:          2 active / 2 total
  skills:             113

config_overrides:
  agent.max_turns: 150
  compression.threshold: 0.8
  display.streaming: True
  display.skin: warm-lightmode
  tts.provider: 
--- end dump ---

---

2026-05-08 17:38:15,215 ERROR [20260508_103200_be4be6] root: Non-retryable client error: Error code: 401 - {'error': {'message': 'Workspace is not authorized in this region.', 'type': None, 'code': None, 'param': None}, 'status': 401}

---

x-openai-internal-codex-residency: <residency>

---

residency = (
    auth_claims.get("chatgpt_data_residency")
    or auth_claims.get("chatgpt_compute_residency")
)
if isinstance(residency, str) and residency.strip():
    headers["x-openai-internal-codex-residency"] = residency.strip()
RAW_BUFFERClick to expand / collapse

Bug Description

Hermes openai-codex requests to https://chatgpt.com/backend-api/codex/responses can fail with:

HTTP 401: Workspace is not authorized in this region.

This happens for ChatGPT workspaces with residency enforcement, even when Codex CLI is logged in and working with the same account. Hermes sends the ChatGPT-Account-ID header but does not send the Codex CLI residency header.

Steps to Reproduce

  • Hermes provider: openai-codex
  • Codex CLI: codex-cli 0.125.0
  • Endpoint: https://chatgpt.com/backend-api/codex
  • Account token claims included chatgpt_data_residency: "us" and chatgpt_compute_residency: "us"

Add openai-codex as a model provider, select it, and start a chat. Use an account which has compute/data residency requirements.

Expected Behavior

Hermes should match Codex CLI request headers closely enough that residency-enforced ChatGPT workspaces can use openai-codex without a 401.

Proposed Fix

Hermes already decodes the Codex OAuth JWT to extract chatgpt_account_id. It should also extract:

  • chatgpt_data_residency
  • fallback: chatgpt_compute_residency

and send:

x-openai-internal-codex-residency: <residency>

Example patch shape:

residency = (
    auth_claims.get("chatgpt_data_residency")
    or auth_claims.get("chatgpt_compute_residency")
)
if isinstance(residency, str) and residency.strip():
    headers["x-openai-internal-codex-residency"] = residency.strip()

Actual Behavior

Error

AuthenticationError [HTTP 401]
Provider: openai-codex  Model: gpt-5.5
Endpoint: https://chatgpt.com/backend-api/codex
Error: HTTP 401: Workspace is not authorized in this region.

Affected Component

CLI (interactive chat)

Messaging Platform (if gateway-related)

No response

Debug Report

--- hermes dump ---
version:          0.13.0 (2026.5.7) [64145a19]
os:               Linux 6.17.0-1014-nvidia aarch64
python:           3.11.15
openai_sdk:       2.31.0
profile:          default
hermes_home:      ~/.hermes
model:            gpt-5.5
provider:         openai-codex
terminal:         local

api_keys:
  openrouter           not set
  openai               not set
  anthropic            not set
  anthropic_token      not set
  nous                 not set
  google/gemini        not set
  gemini               not set
  glm/zai              not set
  zai                  not set
  kimi                 not set
  minimax              not set
  deepseek             not set
  dashscope            not set
  huggingface          not set
  nvidia               not set
  ai_gateway           not set
  opencode_zen         not set
  opencode_go          not set
  kilocode             not set
  firecrawl            not set
  tavily               set
  browserbase          not set
  fal                  not set
  elevenlabs           not set
  github               not set

features:
  toolsets:           hermes-cli
  mcp_servers:        0
  memory_provider:    built-in
  gateway:            running (systemd (user), pid 114864)
  platforms:          telegram, whatsapp
  cron_jobs:          2 active / 2 total
  skills:             113

config_overrides:
  agent.max_turns: 150
  compression.threshold: 0.8
  display.streaming: True
  display.skin: warm-lightmode
  tts.provider: 
--- end dump ---

Operating System

Linux 6.17.0-1014-nvidia aarch64

Python Version

3.11.15

Hermes Version

0.13.0

Additional Logs / Traceback (optional)

2026-05-08 17:38:15,215 ERROR [20260508_103200_be4be6] root: Non-retryable client error: Error code: 401 - {'error': {'message': 'Workspace is not authorized in this region.', 'type': None, 'code': None, 'param': None}, 'status': 401}

Root Cause Analysis (optional)

It seems like Hermes needs to include additional headers when the Codex auth has data residency claims.

See reference in Codex codebase https://github.com/openai/codex/blob/15e79f3c2696672d292c62fa7823e98cd155462a/codex-rs/login/src/auth/default_client.rs#L38

When adding this header, the HTTP 401 error goes away.

Proposed Fix (optional)

Hermes already decodes the Codex OAuth JWT to extract chatgpt_account_id. It should also extract:

  • chatgpt_data_residency
  • fallback: chatgpt_compute_residency

and send:

x-openai-internal-codex-residency: <residency>

Example patch shape:

residency = (
    auth_claims.get("chatgpt_data_residency")
    or auth_claims.get("chatgpt_compute_residency")
)
if isinstance(residency, str) and residency.strip():
    headers["x-openai-internal-codex-residency"] = residency.strip()

Are you willing to submit a PR for this?

  • I'd like to fix this myself and submit a PR

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING