Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix openai-codex provider broken since 2026.4.5 — Cloudflare challenge + missing OAuth scope [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#68033•Fetched 2026-04-18 05:54:18
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
apexict245apexict245
Participants
apexict245apexict245
Timeline (top)
cross-referenced ×1referenced ×1subscribed ×1

Error Message

error=LLM request failed: DNS lookup for the provider endpoint failed. The error message "DNS lookup failed" is misleading — DNS resolves fine, the issue is Cloudflare returning HTML instead of JSON. "error": {

Fix Action

Workaround

Using anthropic/claude-haiku-4-5-20251001 as primary model with direct Anthropic API key. This works reliably but doesn't use the OpenAI Pro subscription.

PR fix notes

PR #97: fix: mark Codex OAuth unavailable, promote OpenAI API key

Description (problem / solution / changelog)

Summary

Responding to OpenAI's Cloudflare restriction on chatgpt.com/backend-api (openclaw/openclaw#68033).

  • Dashboard: ChatGPT (Codex) demoted with ⚠️ + unavailability warning; OpenAI API key promoted to ★ Recommended
  • README (EN + ZH): Remove Codex subscription messaging; refocus on "any provider with a single API key + Docker isolation"

Context

OpenAI blocked all third-party OAuth access to the Codex endpoint. This affects all OpenClaw users, not just ClawFleet. castiel0504 in Discord confirmed the same issue.

🤖 Generated with Claude Code

Changed files

  • README.md (modified, +2/-4)
  • README.zh-CN.md (modified, +2/-4)
  • internal/web/static/js/components/model-asset-dialog.js (modified, +5/-5)
  • internal/web/static/js/i18n.js (modified, +2/-0)

Code Example

HTTP/2 403
cf-mitigated: challenge

---

embedded run agent end: isError=true model=gpt-5.4 provider=openai-codex 
error=LLM request failed: DNS lookup for the provider endpoint failed. 
rawError=<html>...(Cloudflare challenge page)...

---

{
  "error": {
    "message": "Missing scopes: api.responses.write"
  }
}
RAW_BUFFERClick to expand / collapse

Bug Description

The openai-codex provider fails on all models (gpt-5.4, gpt-5.3-codex, gpt-5.2) since approximately version 2026.4.5. Two stacked issues prevent any request from completing.

Environment

  • OpenClaw version: 2026.4.12 (also tested on 2026.4.14)
  • Container: ghcr.io/openclaw/openclaw:latest
  • Platform: Docker on macOS (Colima), arm64
  • Auth method: Codex CLI OAuth (openclaw onboard --auth-choice openai-codex)
  • OpenAI subscription: Pro ($200/mo)

Issue 1: Cloudflare JS Challenge (HTTP 403)

The openai-codex provider uses a hardcoded native route (route=native policy=hidden) that hits chatgpt.com/backend-api. Cloudflare returns a JS challenge that headless containers cannot solve:

HTTP/2 403
cf-mitigated: challenge

Container logs show:

embedded run agent end: isError=true model=gpt-5.4 provider=openai-codex 
error=LLM request failed: DNS lookup for the provider endpoint failed. 
rawError=<html>...(Cloudflare challenge page)...

The error message "DNS lookup failed" is misleading — DNS resolves fine, the issue is Cloudflare returning HTML instead of JSON.

Tested from both container and host — same 403 with cf-mitigated: challenge on all paths:

  • curl https://chatgpt.com/backend-api/codex/v1/responses → 403
  • Both with and without Bearer token

Issue 2: Missing api.responses.write OAuth Scope

The Codex CLI OAuth client (app_EMoamEEZ73f0CkXaXp7hrann) requests scopes: openid profile email offline_access api.connectors.read api.connectors.invoke. It does NOT include api.responses.write.

When testing the token directly against api.openai.com/v1/responses:

{
  "error": {
    "message": "Missing scopes: api.responses.write"
  }
}

Re-authing via openclaw onboard --auth-choice openai-codex issues a fresh token with the same limited scopes.

What We Tried (All Failed)

  1. Revoking OpenClaw consent in OpenAI connected apps settings, then re-authing
  2. Running openclaw onboard --auth-choice openai-codex (fresh token, same scopes)
  3. Upgrading Codex CLI from 0.104.0 to 0.120.0
  4. Pinning to openai-codex/gpt-5.3-codex (same Cloudflare block)
  5. Using the codex/gpt-5.4 provider prefix (separate provider entry in models.json, also fails)
  6. Overriding baseUrl in models.json — the native route (policy=hidden) ignores it

Additional Issue: openclaw onboard Wipes Auth

Running openclaw onboard --auth-choice openai-codex empties agents/main/agent/auth.json (0 bytes). This causes ALL providers to lose authentication until the container is fully restarted with environment variables re-injected. This feels like a separate bug.

Expected Behavior

The openai-codex provider should route requests to the ChatGPT backend API in a way that either:

  • Bypasses Cloudflare challenges (as the Codex CLI itself does)
  • Or uses the public API (api.openai.com/v1/responses) with proper OAuth scopes including api.responses.write

Workaround

Using anthropic/claude-haiku-4-5-20251001 as primary model with direct Anthropic API key. This works reliably but doesn't use the OpenAI Pro subscription.

Reproduction Steps

  1. Deploy OpenClaw 2026.4.12+ in Docker
  2. Run openclaw onboard --auth-choice openai-codex and complete the OAuth flow
  3. Set primary model to openai-codex/gpt-5.4
  4. Send any message
  5. Observe Cloudflare 403 in container logs with cf-mitigated: challenge

extent analysis

TL;DR

To fix the openai-codex provider issue, update the OAuth scopes to include api.responses.write and find a way to bypass the Cloudflare JS challenge.

Guidance

  • The primary issue is the missing api.responses.write OAuth scope, which can be verified by checking the scopes requested by the Codex CLI OAuth client.
  • To mitigate the Cloudflare JS challenge, consider using a proxy or a library that can solve the challenge, as the headless containers cannot solve it.
  • Update the openclaw onboard command to request the required OAuth scopes, including api.responses.write.
  • Test the updated OAuth token against the api.openai.com/v1/responses endpoint to verify that it has the required scopes.

Example

No code snippet is provided as it is not explicitly supported by the issue.

Notes

The issue is specific to the openai-codex provider and the Cloudflare JS challenge. The provided workaround using anthropic/claude-haiku-4-5-20251001 as the primary model with a direct Anthropic API key does not utilize the OpenAI Pro subscription.

Recommendation

Apply a workaround by updating the OAuth scopes and finding a way to bypass the Cloudflare JS challenge, as the root cause of the issue is the missing scope and the Cloudflare challenge.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#configuration error#environment variable#network issue#logging issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING