openclaw - 💡(How to fix) Fix [Bug]: openai-codex provider fails with Cloudflare 403 on headless HTTP after upgrade to 2026.4.5 [1 comments, 1 participants]

openclaw2026-04-06 21:34:07

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#62142•Fetched 2026-04-08 03:08:26

View on GitHub

Comments

Participants

Timeline

Reactions

Author

st4rnin3

Participants

st4rnin3

Timeline (top)

commented ×1

After upgrading to OpenClaw 2026.4.5, the openai-codex provider consistently fails with Cloudflare 403 responses on the chatgpt.com/backend-api/codex/responses endpoint, despite holding a freshly acquired, valid OAuth token. This makes openai-codex/gpt-5.4 and openai-codex/gpt-5.4-mini effectively unusable as primary models.

This is a continuation / re-file of #62087 (accidentally closed).

Error Message

warn {"event":"embedded_run_agent_end","error":"LLM request failed: DNS lookup for the provider endpoint failed.","failoverReason":"auth","model":"gpt-5.4","provider":"openai-codex","rawErrorPreview":"403 <html>\n <head>..."} warn {"event":"embedded_run_agent_end","error":"API rate limit reached. Please try again later.","failoverReason":"auth","model":"gpt-5.4","provider":"openai-codex","rawErrorPreview":"403 <html>..."} Misleading error messages: OpenClaw maps the 403 to auth failure reason, then surfaces it as DNS lookup failed or rate limit reached after retry exhaustion — making diagnosis very difficult.

Root Cause

This is a continuation / re-file of #62087 (accidentally closed).

Fix Action

Fix / Workaround

Upgrade to OpenClaw 2026.4.5
Authenticate: openclaw models auth login → OpenAI Codex → complete OAuth flow
Use any agent with openai-codex/gpt-5.4 or openai-codex/gpt-5.4-mini as primary model
Observe: every request fails with a Cloudflare 403 HTML response

Workaround: openclaw doctor --fix strips the bad keys. But re-auth rewrites them, so the cycle repeats.

Workarounds

Code Example

curl -s -o /tmp/test.txt -w '%{http_code}' \
  -H 'Authorization: Bearer <valid_access_token>' \
  -H 'chatgpt-account-id: <account_id>' \
  -H 'originator: pi' \
  -H 'User-Agent: pi (linux; x86_64)' \
  -H 'OpenAI-Beta: responses=experimental' \
  -H 'accept: text/event-stream' \
  -H 'content-type: application/json' \
  -X POST --data '<valid_payload>' \
  https://chatgpt.com/backend-api/codex/responses
# Returns: 403 with Cloudflare HTML body

---

warn {"event":"embedded_run_agent_end","error":"LLM request failed: DNS lookup for the provider endpoint failed.","failoverReason":"auth","model":"gpt-5.4","provider":"openai-codex","rawErrorPreview":"403 <html>\n  <head>..."}
warn {"event":"embedded_run_agent_end","error":"API rate limit reached. Please try again later.","failoverReason":"auth","model":"gpt-5.4","provider":"openai-codex","rawErrorPreview":"403 <html>..."}

---

Invalid config at /home/openclaw/.openclaw/openclaw.json: Unrecognized keys: "token", "refreshToken"

RAW_BUFFERClick to expand / collapse

Summary

This is a continuation / re-file of #62087 (accidentally closed).

Reproduction Steps

Upgrade to OpenClaw 2026.4.5
Authenticate: openclaw models auth login → OpenAI Codex → complete OAuth flow
Use any agent with openai-codex/gpt-5.4 or openai-codex/gpt-5.4-mini as primary model
Observe: every request fails with a Cloudflare 403 HTML response

Direct test (reproduces reliably):

curl -s -o /tmp/test.txt -w '%{http_code}' \
  -H 'Authorization: Bearer <valid_access_token>' \
  -H 'chatgpt-account-id: <account_id>' \
  -H 'originator: pi' \
  -H 'User-Agent: pi (linux; x86_64)' \
  -H 'OpenAI-Beta: responses=experimental' \
  -H 'accept: text/event-stream' \
  -H 'content-type: application/json' \
  -X POST --data '<valid_payload>' \
  https://chatgpt.com/backend-api/codex/responses
# Returns: 403 with Cloudflare HTML body

Note: The same token against /backend-api/models and /backend-api/usage returns 200 OK — the token is valid. The block is specific to /codex/responses.

Observed Behavior

Gateway logs:

warn {"event":"embedded_run_agent_end","error":"LLM request failed: DNS lookup for the provider endpoint failed.","failoverReason":"auth","model":"gpt-5.4","provider":"openai-codex","rawErrorPreview":"403 <html>\n  <head>..."}
warn {"event":"embedded_run_agent_end","error":"API rate limit reached. Please try again later.","failoverReason":"auth","model":"gpt-5.4","provider":"openai-codex","rawErrorPreview":"403 <html>..."}

Misleading error messages: OpenClaw maps the 403 to auth failure reason, then surfaces it as DNS lookup failed or rate limit reached after retry exhaustion — making diagnosis very difficult.

Secondary Issue: OAuth wizard writes invalid config keys

Each re-auth via openclaw models auth login writes token and refreshToken (empty strings) into openclaw.json under the auth profile. The new schema validator in 2026.4.5 rejects these as unrecognized keys, causing gateway startup failures:

Invalid config at /home/openclaw/.openclaw/openclaw.json: Unrecognized keys: "token", "refreshToken"

Workaround: openclaw doctor --fix strips the bad keys. But re-auth rewrites them, so the cycle repeats.

Additionally, each re-auth adds a second profile (openai-codex:<[email protected]>) alongside the existing openai-codex:default, causing the retry/fallback loop to attempt both profiles before giving up — doubling the timeout delay on every failed request.

Expected Behavior

openai-codex/gpt-5.4 requests succeed when a valid OAuth token is held
Re-auth does not write token/refreshToken keys to openclaw.json
Re-auth does not create duplicate profiles on repeat auth flows

Environment

OpenClaw version: 2026.4.5
Provider: openai-codex
Models affected: gpt-5.4, gpt-5.4-mini
Endpoint: https://chatgpt.com/backend-api/codex/responses
OAuth client: app_EMoamEEZ73f0CkXaXp7hrann
Token status: Valid (confirmed against /models and /usage endpoints, expires 2026-04-16)
Weekly usage: ~43% — not rate limited
OS: Linux (Ubuntu 20.04, kernel 5.15.0)

Workarounds

Switch primary model to anthropic/claude-sonnet-4-6 or another non-Codex provider
Run openclaw doctor --fix after each re-auth to remove invalid config keys
Manually remove duplicate email-based profile from agents/<name>/agent/auth-profiles.json after each re-auth

References

Closed predecessor: #62087
CF block pattern confirmed: Cloudflare JS challenge page returned in response body
Transport layer: @mariozechner/pi-ai → openai-codex-responses.js → buildBaseCodexHeaders() sends originator: pi and User-Agent: pi (linux; x86_64) with no browser cookies or CF clearance token — this headless fingerprint appears to trigger CF mitigation

extent analysis

TL;DR

The most likely fix involves modifying the buildBaseCodexHeaders() function to include a valid Cloudflare clearance token or adjusting the User-Agent header to mimic a browser, as the current headless fingerprint appears to trigger Cloudflare's mitigation.

Guidance

Investigate the buildBaseCodexHeaders() function in openai-codex-responses.js to determine how to include a valid Cloudflare clearance token or adjust the User-Agent header.
Verify that the OAuth token is being passed correctly to the chatgpt.com/backend-api/codex/responses endpoint by checking the request headers in the curl test.
Consider implementing a workaround by switching to a non-Codex provider, such as anthropic/claude-sonnet-4-6, until a fix is found.
Run openclaw doctor --fix after each re-auth to remove invalid config keys and prevent gateway startup failures.

Example

// Example of modified buildBaseCodexHeaders() function
function buildBaseCodexHeaders() {
  const headers = {
    'originator': 'pi',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.3', // Mimic a browser User-Agent
    'accept': 'text/event-stream',
    'content-type': 'application/json',
    'OpenAI-Beta': 'responses=experimental',
    // Add Cloudflare clearance token if available
    // 'cf-clearance': 'YOUR_CLEARANCE_TOKEN'
  };
  return headers;
}

Notes

The issue appears to be related to Cloudflare's mitigation measures, which are triggered by the headless fingerprint of the openai-codex provider. Modifying the User-Agent header or including a valid Cloudflare clearance token may resolve the issue. However, the exact solution will depend on the specific requirements of the chatgpt.com/backend-api/codex/responses endpoint.

Recommendation

Apply a workaround by switching to a non-Codex provider, such as anthropic/claude-sonnet-4-6, until a fix is found for the openai-codex provider. This will allow for continued functionality while a solution is developed for the Cloudflare mitigation issue.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #agent execution #callback error #memory management #API rate limit

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - 💡(How to fix) Fix [Bug]: openai-codex provider fails with Cloudflare 403 on headless HTTP after upgrade to 2026.4.5 [1 comments, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fix / Workaround

Workarounds

Code Example

Summary

Reproduction Steps

Observed Behavior

Secondary Issue: OAuth wizard writes invalid config keys

Expected Behavior

Environment

Workarounds

References

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: openai-codex provider fails with Cloudflare 403 on headless HTTP after upgrade to 2026.4.5 [1 comments, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fix / Workaround

Workarounds

Code Example

Summary

Reproduction Steps

Observed Behavior

Secondary Issue: OAuth wizard writes invalid config keys

Expected Behavior

Environment

Workarounds

References

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

RELATED_DISCOVERY

TRENDING