openclaw - 💡(How to fix) Fix [Bug]: openai/gpt-image-2 via Codex OAuth fails with missing image scope [2 comments, 3 participants]

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

OpenAI image generation with openai/gpt-image-2 fails through Codex OAuth because the OAuth token lacks api.model.images.request, and the shipped OAuth client is rejected when that scope is requested.

Steps to reproduce

1. Configure OpenClaw 2026.4.22 with agents.defaults.imageGenerationModel.primary = "openai/gpt-image-2" and an openai-codex OAuth profile.
2. Do not configure a custom models.providers.openai API key or base URL.
3. Run an image generation request, for example: openclaw infer image generate --model openai/gpt-image-2 --prompt "A friendly robot mascot" --count 1 --size 1024x1024 --output /tmp/openclaw-image-test.png --json.
4. Observe that the OpenAI image request fails with HTTP 401 due to missing api.model.images.request.
5. As a control, patch the local Codex OAuth scope to include api.model.images.request and retry login.
6. Observe OpenAI rejects the OAuth request with invalid_scope, stating the OAuth client is not allowed to request that scope.

Expected behavior

openai/gpt-image-2 should generate an image through the configured openai-codex OAuth profile without requiring OPENAI_API_KEY, matching the documented OAuth routing behavior.

Actual behavior

The image request fails with HTTP 401 because the Codex OAuth token does not include api.model.images.request. When api.model.images.request is added to the local OAuth scope and login is retried, OpenAI rejects the authorization request with invalid_scope.

OpenClaw version

2026.4.22

Operating system

macOS 26.4 (25E246)

Install method

npm global install via Homebrew Node (/opt/homebrew/bin/openclaw, package [email protected])

Model

openai/gpt-image-2

Provider / routing chain

openai/gpt-image-2 image generation provider using openai-codex OAuth profile; no custom models.providers.openai API key or baseUrl configured

Additional provider/model setup details

openclaw infer image providers reports the OpenAI image provider as configured: true, selected: true, with defaultModel: "gpt-image-2".

Config includes:

agents.defaults.imageGenerationModel.primary = "openai/gpt-image-2"

Auth includes an openai-codex OAuth profile. No custom models.providers.openai API key or base URL is configured for the OpenAI image route.

Logs, screenshots, and evidence

Observed OpenAI Images API failure:

`OpenAI image generation failed (HTTP 401): Missing scopes: api.model.images.request`

Control test:

Patched local OAuth scope in:

`/opt/homebrew/lib/node_modules/openclaw/node_modules/@mariozechner/pi-ai/dist/utils/oauth/openai-codex.js`

from:

`const SCOPE = "openid profile email offline_access";`

to:

`const SCOPE = "openid profile email offline_access api.model.images.request";`

The resulting authorize URL included `api.model.images.request`, but OpenAI rejected the callback with:

`error=invalid_scope`

Browser page showed:

`Authentication failed`
`Missing authorization code`

The callback URL contained:

`error=invalid_scope&error_description=The requested scope is invalid, unknown, or malformed. The OAuth 2.0 Client is not allowed to request...`

Attached screenshot shows the `invalid_scope` callback/authentication failure.

http://localhost:1455/auth/callback?error=invalid_scope&error_description=The+requested+scope+is+invalid%2C+unknown%2C+or+malformed.+The+OAuth+2.0+Client+is+not+allowed+to+request+scope+%27api.model.images.request%27.&state=71a5a5cad9ead8f67ee5bd2d05ca39dc

Impact and severity

Affected users/systems/channels: Users attempting to use openai/gpt-image-2 image generation through openai-codex OAuth.

Severity: Blocks the documented OAuth-based OpenAI image generation workflow.

Frequency: Always observed in this tested configuration.

Consequence: Users must either configure a direct OPENAI_API_KEY route or use another image provider, despite docs indicating Codex OAuth should work.

Additional information

OpenClaw version tested: 2026.4.22 (00bd2cf).

The issue was reproduced after validating openclaw.json and confirming the gateway was running. openclaw config validate passed.

The OpenAI image auth resolver appears to fall back to openai-codex OAuth, but the resulting token is not accepted by the OpenAI Images API because it lacks api.model.images.request.

lobster-biscuit