Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug] OpenAI Codex OAuth token refresh fails with 'token has already been used' — Issue #52037 still not fixed in 2026.4.5 [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#62236•Fetched 2026-04-08 03:07:20
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
che-3che-3
Participants
che-3che-3

Error Message

[providers] openai-codex refresh failed OAuthError: Refresh token has already been used.

Root Cause

Based on issue #52037 analysis:

  1. Gateway loads auth-profiles.json at startup
  2. Refresh succeeds in-memory but does NOT write to disk
  3. Next API call loads stale expired token from disk
  4. Refresh token has already been used → 401 error

Fix Action

Fix / Workaround

  1. Is there a workaround to force re-authentication without the CLI hanging?
  2. Is there a config option to use OpenAI API key directly instead of Codex OAuth?
  3. When will this bug be fixed?

Code Example

"openai-codex:default": {
  "type": "oauth",
  "provider": "openai-codex",
  "access": "eyJ...",
  "refresh": "rt_...",
  "expires": 1775139000000,
  "accountId": "30bb02e0-8312-4b83-8ba8-8ae379b96281"
}

---

[providers] openai-codex refresh failed OAuthError: Refresh token has already been used.
RAW_BUFFERClick to expand / collapse

Bug Description

OpenAI Codex OAuth token refresh fails with error: "OAuth token refresh failed for openai-codex: Failed to refresh OpenAI Codex token. Please try again or re-authenticate."

This appears to be the same bug described in issue #52037, but it still occurs in OpenClaw 2026.4.5.

Environment

  • OpenClaw Version: 2026.4.5 (3e72c03)
  • macOS: Darwin 25.4.0 (arm64)
  • Gateway: launchd service

Symptoms

  1. Cron jobs fail with FallbackSummaryError: All models failed (3):

    • Primary model (MiniMax/MiniMax-M2.7): LLM request timed out
    • Fallback 1 (openai-codex/gpt-5.3-codex): OAuth token refresh failed
    • Fallback 2 (openai-codex/gpt-5.4): OAuth token refresh failed

  2. Direct API test with MiniMax succeeds

  3. Manual isolated session runs succeed

  4. Only scheduled (cron) isolated sessions fail

Token Status

From ~/.openclaw/agents/main/agent/auth-profiles.json:

  • openai-codex:default token expired on 2026-04-02 14:10 UTC (~5 days ago)
  • Token expiry timestamp: 1775139000000
"openai-codex:default": {
  "type": "oauth",
  "provider": "openai-codex",
  "access": "eyJ...",
  "refresh": "rt_...",
  "expires": 1775139000000,
  "accountId": "30bb02e0-8312-4b83-8ba8-8ae379b96281"
}

Error Logs

From cron job failures:

[providers] openai-codex refresh failed OAuthError: Refresh token has already been used.

Root Cause

Based on issue #52037 analysis:

  1. Gateway loads auth-profiles.json at startup
  2. Refresh succeeds in-memory but does NOT write to disk
  3. Next API call loads stale expired token from disk
  4. Refresh token has already been used → 401 error

Impact

  • All cron jobs using openai-codex fallbacks are failing
  • Manual runs work because they may use fresh tokens from memory
  • Scheduled runs fail consistently

Related Issues

  • #52037 (original bug report)
  • #54506 (models status overwrites fresh OAuth tokens)

Expected Behavior

Either:

  1. Token refresh should persist to disk correctly, OR
  2. Re-authentication flow should work (currently hangs per #52037)

Questions

  1. Is there a workaround to force re-authentication without the CLI hanging?
  2. Is there a config option to use OpenAI API key directly instead of Codex OAuth?
  3. When will this bug be fixed?

extent analysis

TL;DR

  • The most likely fix is to re-authenticate the OpenAI Codex OAuth token, but since the re-authentication flow is currently hanging, a workaround is needed.

Guidance

  • Try manually updating the auth-profiles.json file with a new refresh token to see if it resolves the issue temporarily.
  • Check if there's an option to use the OpenAI API key directly instead of Codex OAuth, which might bypass the token refresh issue.
  • Consider running the cron jobs in a way that they use fresh tokens from memory, similar to how manual runs work.
  • Investigate if there's a way to force the gateway to reload the updated auth-profiles.json file without restarting the service.

Example

  • No code snippet is provided as it's not clearly supported by the issue, but updating the auth-profiles.json file could look something like this:

"openai-codex:default": { "type": "oauth", "provider": "openai-codex", "access": "new_access_token", "refresh": "new_refresh_token", "expires": new_expiry_timestamp, "accountId": "30bb02e0-8312-4b83-8ba8-8ae379b96281" }


## Notes
- The provided information suggests that the issue is related to the token refresh mechanism, but the exact solution is uncertain due to the hanging re-authentication flow.
- The workaround might not be permanent, and a proper fix would require addressing the underlying issue with the token refresh and re-authentication flow.

## Recommendation
- Apply workaround: Manually update the `auth-profiles.json` file with a new refresh token or explore using the OpenAI API key directly, as these might provide a temporary solution until the bug is fixed.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#authentication issue#prompt issue#agent setup#task chaining

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING