openclaw - 💡(How to fix) Fix openai-codex OAuth provider ignores valid access token, always attempts refresh [1 comments, 1 participants]

Problem

The openai-codex OAuth provider ignores a valid, non-expired access token in ~/.codex/auth.json and immediately attempts to use the refresh token. If the refresh token has already been consumed (single-use OAuth refresh tokens), every request fails with refresh_token_reused (401) — even though the access token is perfectly valid.

Steps to Reproduce

1. Authenticate via codex CLI (writes ~/.codex/auth.json with access_token, refresh_token, id_token)
2. Let a cron job or concurrent request consume the refresh token (race condition — see #62198)
3. Re-authenticate via codex CLI to get fresh tokens
4. Restart the gateway (full stop + start, not SIGUSR1)
5. Observe: gateway still fails with refresh_token_reused on the very first openai-codex request, despite the access token being valid for ~10 days

Observed Behaviour

[openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "refresh_token_reused"
  }
}
[model-fallback/decision] model fallback decision: decision=candidate_failed requested=openai-codex/gpt-5.4 candidate=openai-codex/gpt-5.4 reason=auth next=google-gemini-cli/gemini-3.1-pro-preview

The access token in auth.json has exp: 1776391146 (~Apr 14 2026), verified valid. But it's never used — the gateway goes straight to refresh.

Expected Behaviour

1. On startup, read the access token from auth.json
2. Check if it's expired (JWT exp claim)
3. If valid: use it directly — no refresh needed
4. If expired: then attempt refresh
5. Only prompt for re-auth if both access token is expired AND refresh fails

Workaround

None clean. The access token can't be injected via models.providers.openai-codex.apiKey config because the provider is set to auth: "oauth" mode. Fallback chain catches the failure, so requests succeed via alternative providers.

Environment

• OpenClaw v2026.3.13
• Windows 10
• Provider: openai-codex (OAuth, ~/.codex/auth.json)
• Auth profile: openai-codex:default with mode: "oauth"
• Fresh gateway start (not SIGUSR1 reload)

Related

• #62198 — OAuth refresh token race condition (concurrent cron jobs)