openclaw - 💡(How to fix) Fix [Bug]: openai-codex provider blocked by Cloudflare (403 CF mitigation active) on valid OAuth token [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#62087Fetched 2026-04-08 03:09:10
View on GitHub
Comments
0
Participants
1
Timeline
5
Reactions
0
Author
Participants
Timeline (top)
closed ×2reopened ×2cross-referenced ×1

The openai-codex provider is currently failing with a 403 Forbidden due to Cloudflare mitigation on the ChatGPT backend endpoint, despite holding a freshly acquired and valid OAuth token.

This breaks the default free model paths (openai-codex/gpt-5.4, openai-codex/gpt-5.4-mini).

Root Cause

The openai-codex provider is currently failing with a 403 Forbidden due to Cloudflare mitigation on the ChatGPT backend endpoint, despite holding a freshly acquired and valid OAuth token.

This breaks the default free model paths (openai-codex/gpt-5.4, openai-codex/gpt-5.4-mini).

Fix Action

Fix / Workaround

The openai-codex provider is currently failing with a 403 Forbidden due to Cloudflare mitigation on the ChatGPT backend endpoint, despite holding a freshly acquired and valid OAuth token.

Response (403): <html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <style global>body{font-family:Arial,Helvetica,sans-serif}.container{align-items:center;display:flex;flex
...

Headers confirm: CF mitigation active on this endpoint. The token is valid, but ChatGPT endpoint requires JS/browser validation.

Code Example

Response (403): <html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <style global>body{font-family:Arial,Helvetica,sans-serif}.container{align-items:center;display:flex;flex
...
RAW_BUFFERClick to expand / collapse

Summary

The openai-codex provider is currently failing with a 403 Forbidden due to Cloudflare mitigation on the ChatGPT backend endpoint, despite holding a freshly acquired and valid OAuth token.

This breaks the default free model paths (openai-codex/gpt-5.4, openai-codex/gpt-5.4-mini).

Reproduction

  1. Authenticate via openclaw models auth login \u2192 OpenAI Codex
  2. Successfully exchange the authorization code for a token
  3. Attempt to use the model (e.g. via cron job or standard conversation)
  4. Fails with timeout / 403.

Direct POST to https://chatgpt.com/backend-api/conversation using the saved Bearer token yields:

Response (403): <html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <style global>body{font-family:Arial,Helvetica,sans-serif}.container{align-items:center;display:flex;flex
...

Headers confirm: CF mitigation active on this endpoint. The token is valid, but ChatGPT endpoint requires JS/browser validation.

Impact

  • All jobs and agent turns bound to the openai-codex provider hang until they timeout, then fallback.
  • In environments without paid fallbacks, the system becomes non-functional.
  • Tokens are generating correctly via the app_EMoamEEZ73f0CkXaXp7hrann client, but the API endpoint itself is aggressively blocking headless HTTP clients.

Environment

  • OpenClaw 2026.4.5
  • Provider: openai-codex
  • Models: gpt-5.4, gpt-5.4-mini

extent analysis

TL;DR

The openai-codex provider can be fixed by implementing a workaround to mimic browser-like requests, as the ChatGPT backend endpoint is blocking headless HTTP clients due to Cloudflare mitigation.

Guidance

  • Verify that the OAuth token is valid and correctly exchanged for a token, as the issue is not with token generation but with the API endpoint blocking headless clients.
  • Investigate using a library or tool that can simulate browser-like requests, such as adding headers that mimic a browser or using a headless browser library, to bypass Cloudflare mitigation.
  • Consider using a paid fallback or alternative model to ensure system functionality in environments without paid fallbacks.
  • Review the OpenClaw documentation and OpenAI Codex provider settings to see if there are any existing workarounds or configuration options to address this issue.

Example

import requests

# Add headers to mimic a browser
headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3',
    # Add other browser-like headers as needed
}

# Use the headers with the request
response = requests.post('https://chatgpt.com/backend-api/conversation', headers=headers)

Notes

This workaround may not be foolproof, as Cloudflare mitigation can be complex and subject to change. Additionally, using a headless browser library may introduce additional dependencies and complexity.

Recommendation

Apply workaround: Implementing a browser-like request simulation is the most likely solution to bypass Cloudflare mitigation and restore functionality to the openai-codex provider.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING