Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix OpenAI Codex external-CLI auth can drift in long-running gateway and hit refresh_token_reused [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#63385•Fetched 2026-04-09 07:54:29
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
fista42fista42
Participants
fista42fista42

When OpenClaw reuses Codex CLI auth from ~/.codex/auth.json, a long-running gateway can keep an older in-memory openai-codex:default refresh-token lineage after Codex CLI rotates its tokens. Later, OpenClaw attempts a refresh with the older lineage and receives refresh_token_reused.

Root Cause

When OpenClaw reuses Codex CLI auth from ~/.codex/auth.json, a long-running gateway can keep an older in-memory openai-codex:default refresh-token lineage after Codex CLI rotates its tokens. Later, OpenClaw attempts a refresh with the older lineage and receives refresh_token_reused.

RAW_BUFFERClick to expand / collapse

Summary

When OpenClaw reuses Codex CLI auth from ~/.codex/auth.json, a long-running gateway can keep an older in-memory openai-codex:default refresh-token lineage after Codex CLI rotates its tokens. Later, OpenClaw attempts a refresh with the older lineage and receives refresh_token_reused.

Expected

Based on the OpenClaw docs for Codex OAuth reuse/token-sink behavior, long-running gateways should keep external Codex CLI auth effectively externally managed. If ~/.codex/auth.json is newer, the runtime should re-read it before spending the copied refresh token lineage, or otherwise invalidate the stale runtime snapshot.

Actual

In the installed 2026.4.5 code path, external CLI sync appears to happen when the auth store is loaded (syncExternalCliCredentials* in profiles-COPO-hHI.js). The runtime also keeps auth-store snapshots in memory. This allows a sequence where:

  1. Gateway starts and loads/snapshots openai-codex:default
  2. Codex CLI later refreshes/reauthenticates and rotates ~/.codex/auth.json
  3. Gateway keeps using the older in-memory lineage
  4. A later OpenClaw refresh attempt fails with refresh_token_reused

Repro shape

  • OpenClaw version: 2026.4.5
  • Provider: openai-codex
  • Auth source reused from Codex CLI: ~/.codex/auth.json
  • Long-running gateway process
  • Codex CLI rotates tokens after gateway startup
  • Later gateway auth refresh hits stale lineage

Why I think this is the gap

Local inspection shows:

  • external CLI sync functions: readCodexCliCredentialsCached, syncExternalCliCredentials*
  • runtime auth snapshots: runtimeAuthStoreSnapshots, replaceRuntimeAuthProfileStoreSnapshots, resolveRuntimeAuthProfileStore
  • sync is called from auth-store load paths, not from a visible watch/reload-before-refresh path

Suggested fix directions

  • Re-read external Codex CLI auth before any local refresh attempt for external-CLI-managed openai-codex
  • or invalidate/reload runtime auth snapshots when the external auth source is newer
  • or mark Codex CLI-reused credentials as externally managed and never spend the copied refresh token locally when a fresher external source exists

Operator impact

Without this, users can end up needing a gateway restart after Codex CLI token rotation, which seems contrary to the intended external-managed behavior.

extent analysis

TL;DR

Re-read external Codex CLI auth before any local refresh attempt to prevent using stale refresh token lineages.

Guidance

  • Verify that the syncExternalCliCredentials* function is called before any refresh attempt to ensure the latest credentials are used.
  • Check the runtimeAuthStoreSnapshots and replaceRuntimeAuthProfileStoreSnapshots functions to see if they can be modified to invalidate or reload the auth snapshots when the external auth source is newer.
  • Consider adding a check to mark Codex CLI-reused credentials as externally managed and prevent spending the copied refresh token locally when a fresher external source exists.
  • Review the readCodexCliCredentialsCached function to ensure it is correctly updating the cached credentials when the external auth source changes.

Example

No specific code snippet is provided as the issue lacks detailed implementation details, but the suggested fix directions can be used as a starting point for modifying the relevant functions.

Notes

The issue seems to be related to the timing of when the external CLI sync is performed, and how the runtime auth snapshots are handled. The suggested fix directions provide possible solutions, but the exact implementation may vary depending on the specific requirements and constraints of the system.

Recommendation

Apply a workaround to re-read external Codex CLI auth before any local refresh attempt, as this seems to be the most straightforward solution to prevent using stale refresh token lineages. This approach ensures that the latest credentials are used, reducing the need for gateway restarts after Codex CLI token rotation.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#callback error#memory management#API rate limit#retriever error#indexing error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING