openclaw - 💡(How to fix) Fix [Bug]: Regression in 2026.3.23(-2): openai-codex OAuth succeeds but model becomes unusable with refresh_token_reused [2 comments, 3 participants]

openclaw2026-03-25 06:21:41

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#54284•Fetched 2026-04-08 01:29:41

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Participants

Timeline (top)

commented ×2labeled ×2subscribed ×2

After upgrading OpenClaw from 2026.3.13 to 2026.3.23 / 2026.3.23-2, openai-codex/gpt-5.4 stopped working in my main agent.

OAuth login completes successfully, but the provider immediately fails with:

[openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "code": "refresh_token_reused"
  }
}

Downgrading back to 2026.3.13 restores normal behavior.

This looks like a regression in 2026.3.23 / 2026.3.23-2, at least on my setup.

Error Message

"error": { "error": {

Root Cause

After upgrading OpenClaw from 2026.3.13 to 2026.3.23 / 2026.3.23-2, openai-codex/gpt-5.4 stopped working in my main agent.

OAuth login completes successfully, but the provider immediately fails with:

[openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "code": "refresh_token_reused"
  }
}

Downgrading back to 2026.3.13 restores normal behavior.

This looks like a regression in 2026.3.23 / 2026.3.23-2, at least on my setup.

Fix Action

Fix / Workaround

Start from a working setup on 2026.3.13
Use openai-codex/gpt-5.4 as the main model
Upgrade to 2026.3.23 or 2026.3.23-2
Run OAuth login again for openai-codex
Check model status or send a message through the agent
Observe refresh_token_reused and Codex failing to work
Downgrade back to 2026.3.13
Observe that Codex works again

Code Example

[openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "code": "refresh_token_reused"
  }
}

Downgrading back to 2026.3.13 restores normal behavior.

This looks like a regression in 2026.3.23 / 2026.3.23-2, at least on my setup.

### Steps to reproduce

1. Start from a working setup on 2026.3.13
2. Use openai-codex/gpt-5.4 as the main model
3. Upgrade to 2026.3.23 or 2026.3.23-2
4. Run OAuth login again for openai-codex
5. Check model status or send a message through the agent
6. Observe refresh_token_reused and Codex failing to work
7. Downgrade back to 2026.3.13
8. Observe that Codex works again

### Expected behavior

openai-codex/gpt-5.4 should continue working after OAuth login, just like it did on 2026.3.13.

### Actual behavior

OAuth flow reports success:

OpenAI OAuth complete
Updated ~/.openclaw/openclaw.json
Auth profile: openai-codex:default (openai-codex/oauth)
Default model available: openai-codex/gpt-5.4

But openclaw models status shows token refresh failures and the model cannot be used reliably:

[openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "refresh_token_reused"
  }
}
- openai-codex
  - openai-codex:default ok expires in 0m

In the UI / agent run path, this leads to Codex becoming unusable even though login succeeded.

### OpenClaw version

OpenClaw 2026.3.23-2

### Operating system

macOS 26.3.1(a)

### Install method

pnpm

### Model

openai-codex/gpt-5.4

### Provider / routing chain

openclaw -> feishu -> openai-codex/gpt-5.4

### Additional provider/model setup details

_No response_

### Logs, screenshots, and evidence

RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Summary

After upgrading OpenClaw from 2026.3.13 to 2026.3.23 / 2026.3.23-2, openai-codex/gpt-5.4 stopped working in my main agent.

OAuth login completes successfully, but the provider immediately fails with:

[openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "code": "refresh_token_reused"
  }
}

Downgrading back to 2026.3.13 restores normal behavior.

This looks like a regression in 2026.3.23 / 2026.3.23-2, at least on my setup.

### Steps to reproduce

1. Start from a working setup on 2026.3.13
2. Use openai-codex/gpt-5.4 as the main model
3. Upgrade to 2026.3.23 or 2026.3.23-2
4. Run OAuth login again for openai-codex
5. Check model status or send a message through the agent
6. Observe refresh_token_reused and Codex failing to work
7. Downgrade back to 2026.3.13
8. Observe that Codex works again

### Expected behavior

openai-codex/gpt-5.4 should continue working after OAuth login, just like it did on 2026.3.13.

### Actual behavior

OAuth flow reports success:

OpenAI OAuth complete
Updated ~/.openclaw/openclaw.json
Auth profile: openai-codex:default (openai-codex/oauth)
Default model available: openai-codex/gpt-5.4

But openclaw models status shows token refresh failures and the model cannot be used reliably:

[openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "refresh_token_reused"
  }
}
- openai-codex
  - openai-codex:default ok expires in 0m

In the UI / agent run path, this leads to Codex becoming unusable even though login succeeded.

### OpenClaw version

OpenClaw 2026.3.23-2

### Operating system

macOS 26.3.1(a)

### Install method

pnpm

### Model

openai-codex/gpt-5.4

### Provider / routing chain

openclaw -> feishu -> openai-codex/gpt-5.4

### Additional provider/model setup details

_No response_

### Logs, screenshots, and evidence

```shell

Impact and severity

This blocks upgrading for users who rely on openai-codex as their primary model.

Additional information

No response

extent analysis

Fix Plan

To resolve the refresh_token_reused error after upgrading OpenClaw, we need to modify the OAuth token refresh logic. Here are the steps:

Update the openclaw.json configuration file to include a unique client_id for each OAuth provider.
Modify the token refresh endpoint to handle the refresh_token_reused error by retrying the refresh with a new refresh token.

Example code changes:

# Update openclaw.json configuration file
{
  "providers": {
    "openai-codex": {
      "client_id": "unique_client_id",
      "client_secret": "client_secret",
      "refresh_token": "refresh_token"
    }
  }
}

# Modify token refresh endpoint
import requests

def refresh_token(provider, refresh_token):
    try:
        response = requests.post(
            f"https://{provider}/oauth2/token",
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            data={
                "grant_type": "refresh_token",
                "refresh_token": refresh_token,
                "client_id": "unique_client_id",
                "client_secret": "client_secret"
            }
        )
        response.raise_for_status()
        return response.json()["access_token"]
    except requests.exceptions.HTTPError as e:
        if e.response.status_code == 401 and "refresh_token_reused" in e.response.text:
            # Retry with a new refresh token
            new_refresh_token = get_new_refresh_token()
            return refresh_token(provider, new_refresh_token)
        raise

Verification

To verify the fix, follow these steps:

Upgrade OpenClaw to the latest version.
Run OAuth login again for openai-codex.
Check the model status or send a message through the agent.
Verify that the token refresh failures are resolved and the model is working reliably.

Extra Tips

To prevent similar issues in the future, make sure to:

Regularly review and update the OAuth token refresh logic to handle errors and edge cases.
Use unique client_id values for each OAuth provider to avoid conflicts.
Implement retry mechanisms for token refresh failures to improve reliability.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

openai-codex/gpt-5.4 should continue working after OAuth login, just like it did on 2026.3.13.

#agent execution #callback error #memory management #API rate limit #retriever error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - 💡(How to fix) Fix [Bug]: Regression in 2026.3.23(-2): openai-codex OAuth succeeds but model becomes unusable with refresh_token_reused [2 comments, 3 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fix / Workaround

Code Example

Bug type

Summary

Impact and severity

Additional information

extent analysis

Fix Plan

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: Regression in 2026.3.23(-2): openai-codex OAuth succeeds but model becomes unusable with refresh_token_reused [2 comments, 3 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fix / Workaround

Code Example

Bug type

Summary

Impact and severity

Additional information

extent analysis

Fix Plan

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING