Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix OpenAI Codex OAuth: 401 api.responses.write scope missing after 2026.4.9 upgrade [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#64133•Fetched 2026-04-11 06:16:20
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
Max-ResilientMax-Resilient
Participants
Max-ResilientMax-Resilient
Timeline (top)
cross-referenced ×2

Root Cause

The openai-codex provider was routing requests to api.openai.com/v1/responses (via openai-responses transport) instead of chatgpt.com/backend-api/codex/responses (via openai-codex-responses transport). The codex-specific endpoint doesn't require api.responses.write — it's the same endpoint the official Codex CLI uses with ChatGPT OAuth tokens.

The bug is in the transport normalization: normalizeCodexTransport() only rewrites openai-responses → openai-codex-responses, but somewhere in the model resolution chain the model was arriving with openai-responses and not being rewritten, or the catalog was providing the wrong defaults.

Fix Action

Fix

Ensure the openai-codex provider catalog and all dynamic model resolution paths use:

  • api: "openai-codex-responses" (NOT openai-responses or openai-completions)
  • baseUrl: "https://chatgpt.com/backend-api" (NOT api.openai.com/v1)

This routes through the codex-specific responses endpoint which accepts ChatGPT OAuth tokens.

Workaround

Update ~/.openclaw/openclaw.json and ~/.openclaw/agents/main/agent/models.json to set the openai-codex provider to:

{
  "baseUrl": "https://chatgpt.com/backend-api",
  "api": "openai-codex-responses",
  "models": [...]
}

And ensure per-model entries also have "api": "openai-codex-responses".

PR fix notes

PR #64286: openai-codex: fix auth scope handling and classify provider/runtime failures

Description (problem / solution / changelog)

Summary

This is PR 2 of the GPT-5.4 / Codex agentic runtime parity program tracked in #64227 and scoped by #64229.

It fixes the maintained-source OpenAI Codex OAuth scope gap in OpenClaw's login wrapper and adds a separate provider/runtime failure taxonomy that makes auth-scope, refresh, HTML 403, proxy, DNS, timeout, schema, sandbox-blocked, and replay-invalid failures observable in logs and easier to explain to users.

What changed

  • normalize OpenAI Codex authorize URLs so the required scopes are always present:
    • openid
    • profile
    • email
    • offline_access
    • model.request
    • api.responses.write
  • add classifyProviderRuntimeFailureKind(...) as a typed provider/runtime failure classifier
  • keep the older failover-reason contract intact instead of widening it in this slice
  • thread providerRuntimeFailureKind through embedded-run observation fields and lifecycle logging
  • surface more truthful user-facing copy for:
    • OAuth refresh failures
    • missing OpenAI Codex scopes
    • HTML 403 auth failures
    • proxy/tunnel misroutes
    • replay-invalid failures
  • add focused regressions for scope failures, refresh failures, HTML 403, proxy, DNS, timeout, schema, sandbox-blocked, and replay-invalid paths

Why

GPT-5.4 / Codex failures in OpenClaw are still too easy to misdiagnose as generic model stops. This slice makes the auth/runtime layer tell the truth before we move on to tool-contract and parity-harness work.

Non-goals

  • does not implement tool compatibility work from #64230
  • does not implement permission truthfulness work from #64231
  • does not implement replay/liveness hardening from #64232
  • does not implement the benchmark harness from #64233
  • does not widen the generic failover-reason enum for every caller in this slice

Builds on prior groundwork

  • #45176
  • #48592
  • #53702
  • #55206
  • #44019

Validation

Focused checks run:

  • CI=1 pnpm exec vitest run src/commands/openai-codex-oauth.test.ts src/agents/pi-embedded-helpers.formatassistanterrortext.test.ts src/agents/pi-embedded-helpers.isbillingerrormessage.test.ts src/agents/failover-error.test.ts src/agents/pi-embedded-error-observation.test.ts src/agents/pi-embedded-subscribe.handlers.lifecycle.test.ts
  • repo hook gate during commit:
    • pnpm check:no-conflict-markers
    • pnpm tool-display:check
    • pnpm check:host-env-policy:swift
    • pnpm tsgo
    • node scripts/prepare-extension-package-boundary-artifacts.mjs
    • pnpm lint
    • pnpm lint:webhook:no-low-level-body-read
    • pnpm lint:auth:no-pairing-store-group
    • pnpm lint:auth:pairing-account-scope

Linked issues

  • Closes #64229
  • Refs #64227
  • Refs #64133
  • Refs #64174
  • Refs #64092
  • Refs #57399
  • Refs #62672

Changed files

  • src/agents/failover-error.test.ts (modified, +10/-0)
  • src/agents/pi-embedded-error-observation.test.ts (modified, +14/-0)
  • src/agents/pi-embedded-error-observation.ts (modified, +23/-4)
  • src/agents/pi-embedded-helpers.formatassistanterrortext.test.ts (modified, +67/-0)
  • src/agents/pi-embedded-helpers.isbillingerrormessage.test.ts (modified, +79/-0)
  • src/agents/pi-embedded-helpers.ts (modified, +2/-0)
  • src/agents/pi-embedded-helpers/errors.ts (modified, +219/-4)
  • src/agents/pi-embedded-subscribe.handlers.lifecycle.test.ts (modified, +22/-0)
  • src/agents/pi-embedded-subscribe.handlers.lifecycle.ts (modified, +16/-3)
  • src/commands/openai-codex-oauth.test.ts (modified, +28/-3)
  • src/plugins/provider-openai-codex-oauth.ts (modified, +40/-1)

Code Example

HTTP 401: You have insufficient permissions for this operation. Missing scopes: api.responses.write.

---

{
  "baseUrl": "https://chatgpt.com/backend-api",
  "api": "openai-codex-responses",
  "models": [...]
}
RAW_BUFFERClick to expand / collapse

Bug

All OpenAI Codex provider calls via ChatGPT OAuth fail with:

HTTP 401: You have insufficient permissions for this operation. Missing scopes: api.responses.write.

This broke around April 7–9, 2026. Affects all recent versions (confirmed 2026.4.5, 2026.4.8, 2026.4.9). The issue is that OpenAI started enforcing scopes on api.openai.com, and ChatGPT OAuth tokens don't include api.responses.write.

Note to the OpenClaw / OpenAI team

OpenClaw is now an OpenAI product, and the Codex CLI is also an OpenAI product. Both use the same ChatGPT OAuth flow. The Codex CLI correctly routes through chatgpt.com/backend-api/codex/responses, but OpenClaw's openai-codex provider was routing to api.openai.com/v1/responses instead — an endpoint that rejects ChatGPT OAuth tokens. These are your own products and they need to be compatible with each other. The OAuth tokens your own auth flow issues should work with the endpoints your own provider code targets.

Root Cause

The openai-codex provider was routing requests to api.openai.com/v1/responses (via openai-responses transport) instead of chatgpt.com/backend-api/codex/responses (via openai-codex-responses transport). The codex-specific endpoint doesn't require api.responses.write — it's the same endpoint the official Codex CLI uses with ChatGPT OAuth tokens.

The bug is in the transport normalization: normalizeCodexTransport() only rewrites openai-responses → openai-codex-responses, but somewhere in the model resolution chain the model was arriving with openai-responses and not being rewritten, or the catalog was providing the wrong defaults.

Fix

Ensure the openai-codex provider catalog and all dynamic model resolution paths use:

  • api: "openai-codex-responses" (NOT openai-responses or openai-completions)
  • baseUrl: "https://chatgpt.com/backend-api" (NOT api.openai.com/v1)

This routes through the codex-specific responses endpoint which accepts ChatGPT OAuth tokens.

Workaround

Update ~/.openclaw/openclaw.json and ~/.openclaw/agents/main/agent/models.json to set the openai-codex provider to:

{
  "baseUrl": "https://chatgpt.com/backend-api",
  "api": "openai-codex-responses",
  "models": [...]
}

And ensure per-model entries also have "api": "openai-codex-responses".

Environment

  • OpenClaw: 2026.4.5 / 2026.4.8 / 2026.4.9
  • Provider: openai-codex with ChatGPT OAuth
  • Model: gpt-5.4
  • OS: macOS (Darwin 25.4.0)

extent analysis

TL;DR

Update the openai-codex provider configuration to use the openai-codex-responses API and https://chatgpt.com/backend-api base URL to fix the authentication issue.

Guidance

  • Verify that the openai-codex provider is configured to use api: "openai-codex-responses" and baseUrl: "https://chatgpt.com/backend-api" in the catalog and dynamic model resolution paths.
  • Update ~/.openclaw/openclaw.json and ~/.openclaw/agents/main/agent/models.json to reflect the correct configuration for the openai-codex provider.
  • Ensure that per-model entries also have the correct api setting, which is "openai-codex-responses".
  • Test the updated configuration to confirm that the authentication issue is resolved.

Example

{
  "baseUrl": "https://chatgpt.com/backend-api",
  "api": "openai-codex-responses",
  "models": [...]
}

Notes

This fix assumes that the issue is solely related to the incorrect API and base URL configuration for the openai-codex provider. If other factors are contributing to the authentication issue, additional troubleshooting may be necessary.

Recommendation

Apply the workaround by updating the openai-codex provider configuration to use the correct API and base URL, as this is a targeted fix for the identified issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#agent setup#task chaining#parallel task#integration issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING