OAuth Authorization Fails with HTTP 400 in OpenCode Desktop 2.0.28 on Windows #55211

Activity

1. opencode-agent commented on Oct 13, 2026

   

   opencode-agentBot

   on Oct 13, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I couldn't reproduce this here because it needs a real ChatGPT account (and ideally Windows with OpenCode Desktop), which this environment doesn't have.

   From the code, "Request failed: 400" comes from the last step of "Sign in with ChatGPT". After you approve in the browser, OpenCode exchanges the code for tokens, and ChatGPT's server is rejecting that request. Right now OpenCode only shows the status code and drops ChatGPT's error details, which is why your logs don't show the cause. That code hasn't changed between 2.0.28 and the latest dev.

   A maintainer with a ChatGPT account will need to look into it. In the meantime, these would help:

   • Have you signed in with ChatGPT in OpenCode before, on this machine or account? Does it still fail after removing any existing OpenAI/ChatGPT connection in OpenCode and trying again?
   • Does the legacy "Codex browser" sign-in method under OpenAI work?
   • Which ChatGPT plan you're on (Plus, Pro, Team/Business, Enterprise).
2. GWGWSEUI commented on Oct 13, 2026

   

   GWGWSEUI

   on Oct 13, 2026

   Author

   More actions

   My ChatGPT account is on the Free plan. The legacy "Codex browser" sign-in method under OpenAI works successfully, but the regular "Sign in with ChatGPT" flow fails with HTTP 400 after I approve authorization in the browser.
3. jaapdeheer commented on Oct 20, 2026

   

   jaapdeheer

   on Oct 20, 2026

   More actions

   Same here, on macOS with the CLI (2.0.26), ChatGPT Plus plan.

   In my case it worked fine first. The log shows the OpenAI credential refreshing successfully at 11:34 and 12:46 UTC today, and it was working fine. After a few hours idle (afk), every message now fails with Request failed: 400. A fresh opencode auth login openai with "Sign in with ChatGPT" fails the same way as @GWGWSEUI's screenshot above.

   The legacy Codex login does work for me, but it doesn't really help: both gpt-6.1-sol and gpt-6-astra are rejected with "The '...' model is not supported when using Codex with a ChatGPT account."

   Other providers (e.g. Anthropic) still work fine.
4. yookibooki commented on Oct 21, 2026

   

   yookibooki

   on Oct 21, 2026

   More actions

   I’m experiencing the same ChatGPT sign-in failure: after authorization, OpenCode shows “Authorization failed” and “Request failed: 400.” It happens consistently.

   Environment: OpenCode v2.1.1 on Linux x64, using tmux and Bash.
5. chubi-x commented on Oct 21, 2026

   

   chubi-x

   on Oct 21, 2026

   More actions

   Im also experiencing this failure. v2.1.1 on linux x64
6. v44r commented on Oct 23, 2026

   

   v44r

   on Oct 23, 2026

   More actions

   Error persists in v2.1.3.
7. JMoCoder commented on Oct 24, 2026

   

   JMoCoder

   on Oct 24, 2026

   More actions

   Reproduced on Linux x64 with OpenCode 2.1.4 (headless server, not Desktop, not Windows). Same failure as the screenshot: after browser approval, the local callback page is "Authorization failed" and the attempt status is failed / Request failed: 400. No OpenAI connection is stored.

   This is not the loopback "connection refused" problem. The browser was on another machine, so the first redirect to 127.0.0.1:<port>/auth/callback never reached the server. For the reproduction below, the callback was delivered with a local request to a listener that was still bound on 127.0.0.1. OpenCode accepted that callback (state matched; the response was its own 400 HTML page, not a refused TCP connection) and then failed while exchanging the code.

   Method: chatgpt-token-sharing ("Sign in with ChatGPT").
   Token endpoint: POST https://auth.openai.com/api/accounts/oauth/token.
   Authorize URL used client_id=dynamic_agent_client and redirect_uri=http://127.0.0.1:<ephemeral>/auth/callback.
   The callback included an issued oaiapp_… client id. There was no existing OpenAI connection.

   Installed 2.1.4 behavior, from the binary:

   • The callback handler reads code and client_id. A state mismatch or a missing code is a different error ("Invalid OAuth state" / "Missing authorization code"). We did not get those.
   • If a saved client id exists and the callback client id differs, the attempt fails with "ChatGPT returned a different client than this connection." We did not get that either, which matches "no saved connection".
   • Otherwise it exchanges with client_id = saved ?? callback client_id, the same redirect_uri, code_verifier, and resource=https://api.openai.com/v1. So this 400 is not "the token request still sent dynamic_agent_client".
   • On any non-2xx token response, the client throws Request failed: ${status} and discards the body. That is why 2.1.4 logs still cannot show invalid_grant / invalid_client / error_description. This matches the 2026-10-13 note that the detail is dropped, and it is still true one release after the 2.1.3 report.
   • The issued oaiapp_… id is written only after a successful token response. After this 400, a new attempt still starts at dynamic_agent_client. OpenAI's token-sharing guide says a failed exchange should be retried with the issued client id retained, not by starting another dynamic registration. 2.1.4 does not do that. That can explain a loop of new oaiapp_… ids, but without the discarded body it is not proven to be the cause of this particular 400.

   Ruled out for this reproduction:

   • Proxy/VPN on the Windows Desktop report. This host had a live loopback listener and still got the 400 from the token endpoint.
   • V2: ChatGPT subscription (OpenAI OAuth) not routed to codex backend — HTTP 401 missing api.responses.write #34765 (401 api.responses.write after a successful Codex login) and ChatGPT token sharing: changing reasoning effort causes HTTP 400 and breaks session continuation #54075 (400 subscription_sharing_unsupported_capability after login, when changing reasoning effort). Both require a stored credential. None was stored here.
   • Legacy Codex browser login is a different method (chatgpt-browser, client app_EMoamEEZ73f0CkXaXp7hrann, /oauth/token). It is not evidence that token-sharing exchange is healthy.

   Useful logging change, without guessing the OpenAI error: include the token endpoint's JSON error and error_description in the attempt message and the server log, and do not persist secrets. #56782 is the same gap for 400/429 on re-auth.
8. chubi-x commented on Oct 25, 2026

   

   chubi-x

   on Oct 25, 2026 via email

   More actions

   I actually discovered that it's possible I was getting this issue because my subscription downgraded to free version. I'm yet to resubscribe but I'm pretty sure it'll fix the issue in my case Sent from Outlook for Android<https://aka.ms/AAb9ysg>

   …

   ________________________________ From: Jiamo ***@***.***> Sent: Saturday, 24 October 2026 06:08:02 To: anomalyco/opencode ***@***.***> Cc: ADEJOH Chubiyojo ***@***.***>; Comment ***@***.***> Subject: Re: [anomalyco/opencode] OAuth Authorization Fails with HTTP 400 in OpenCode Desktop 2.0.28 on Windows (Issue #55211) [https://avatars.githubusercontent.com/u/198521061?s=20&v=4]JMoCoder left a comment (anomalyco/opencode#55211)<https://protect.checkpoint.com/v2/r02/___https://github.com/anomalyco/opencode/issues/55211%23issuecomment-6379662191___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OmI2Nzk6ZmE0NjBhMmY1YTY1OTc1ZWY3MjlmNGQ5YWVhOGM3YTgzYTgwYmQ4NjdmOTY1YjQ1NWRiZDU3YmVkYzZjMWM5MTpoOlQ6Tg> Reproduced on Linux x64 with OpenCode 2.1.4 (headless server, not Desktop, not Windows). Same failure as the screenshot: after browser approval, the local callback page is "Authorization failed" and the attempt status is failed / Request failed: 400. No OpenAI connection is stored. This is not the loopback "connection refused" problem. The browser was on another machine, so the first redirect to 127.0.0.1:<port>/auth/callback never reached the server. For the reproduction below, the callback was delivered with a local request to a listener that was still bound on 127.0.0.1. OpenCode accepted that callback (state matched; the response was its own 400 HTML page, not a refused TCP connection) and then failed while exchanging the code. Method: chatgpt-token-sharing ("Sign in with ChatGPT"). Token endpoint: POST https://protect.checkpoint.com/v2/r02/___https://auth.openai.com/api/accounts/oauth/token___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OjQwZGQ6ODlmZDkyMzFlNDUwYWU4NWY4ZjhjMzQwMjM1ZTliMDQ4YzljZWE4MTZkZjE1OGU3MWY2OGViYTg5Y2MzNDQ4NDp0OlQ6Tg. Authorize URL used client_id=dynamic_agent_client and redirect_uri=http://127.0.0.1:<ephemeral>/auth/callback. The callback included an issued oaiapp_… client id. There was no existing OpenAI connection. Installed 2.1.4 behavior, from the binary: * The callback handler reads code and client_id. A state mismatch or a missing code is a different error ("Invalid OAuth state" / "Missing authorization code"). We did not get those. * If a saved client id exists and the callback client id differs, the attempt fails with "ChatGPT returned a different client than this connection." We did not get that either, which matches "no saved connection". * Otherwise it exchanges with client_id = saved ?? callback client_id, the same redirect_uri, code_verifier, and resource=https://api.openai.com/v1. So this 400 is not "the token request still sent dynamic_agent_client". * On any non-2xx token response, the client throws Request failed: ${status} and discards the body. That is why 2.1.4 logs still cannot show invalid_grant / invalid_client / error_description. This matches the 2026-10-13 note that the detail is dropped, and it is still true one release after the 2.1.3 report. * The issued oaiapp_… id is written only after a successful token response. After this 400, a new attempt still starts at dynamic_agent_client. OpenAI's token-sharing guide says a failed exchange should be retried with the issued client id retained, not by starting another dynamic registration. 2.1.4 does not do that. That can explain a loop of new oaiapp_… ids, but without the discarded body it is not proven to be the cause of this particular 400. Ruled out for this reproduction: * Proxy/VPN on the Windows Desktop report. This host had a live loopback listener and still got the 400 from the token endpoint. * #34765<https://protect.checkpoint.com/v2/r02/___https://github.com/anomalyco/opencode/issues/34765___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OmM1NGQ6N2Q5OGY4MDUwNmM0NGFjZDQ2N2NmNTFjNzFlMGVmN2E4YmZmZTMwYzBhOTM2NmY1YzViYTQzYjIzZmI0MzYwZTpoOlQ6Tg> (401 api.responses.write after a successful Codex login) and #54075<https://protect.checkpoint.com/v2/r02/___https://github.com/anomalyco/opencode/issues/54075___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OmVlZWM6OTlhNGUzZDk2ZWFmMmE4ZDRjMzNjOWFhNTRlYzdkZDE1YWI5ZTYyMjA5YzNlOTk3N2Q1MzI3ZTQ5ZjQ4YjVhMTpoOlQ6Tg> (400 subscription_sharing_unsupported_capability after login, when changing reasoning effort). Both require a stored credential. None was stored here. * Legacy Codex browser login is a different method (chatgpt-browser, client app_EMoamEEZ73f0CkXaXp7hrann, /oauth/token). It is not evidence that token-sharing exchange is healthy. Useful logging change, without guessing the OpenAI error: include the token endpoint's JSON error and error_description in the attempt message and the server log, and do not persist secrets. #56782<https://protect.checkpoint.com/v2/r02/___https://github.com/anomalyco/opencode/issues/56782___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OmRmYTg6NzAyZTdmNWVkNjcyNzY1MGFkNDEwMWM0ODAwNzYwODQ1M2ZjNmY0ZTA0MWZhNzI2ZDllOWU5ZGZiMTU5OGY1MDpoOlQ6Tg> is the same gap for 400/429 on re-auth. — Reply to this email directly, view it on GitHub<https://protect.checkpoint.com/v2/r02/___https://github.com/anomalyco/opencode/issues/55211?email_source=notifications&email_token=AIJZTNVF435C4N7WAEEFJB35VQTKFA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZXHE3DMMRRHEY2M4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM%23issuecomment-6379662191___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OjEzMTQ6Y2RkNTFjYzgwYjRmNDhiMTlkYmI1YjJkZGRjYzczNGU4Mzk5NDE5NzhhOTJjZTIxMmFhNDc2MmQ1ZTU0NjExMDpoOlQ6Tg>, or unsubscribe<https://protect.checkpoint.com/v2/r02/___https://github.com/notifications/unsubscribe-auth/AIJZTNTEH2HICFXD4AHKKI35VQTKFAVCNFSNUABFKJSXA33TNF2G64TZHM4TONJXGM2DGMJZHNEXG43VMU5TKOBTGU3DGNRQHE22C5QC___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OjNlNGQ6ZTFkODk0MDJjMTdjOTQxNWMwZGU3YWQzNGUwZThmYjYxNzBmMTlmNzJiNjBiNzI2OGQxMWI0NWRkYzU5MWY0OTpoOlQ6Tg>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://protect.checkpoint.com/v2/r02/___https://github.com/notifications/mobile/ios/AIJZTNTNEWRU6CVUQ5LTB6T5VQTKFA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZXHE3DMMRRHEY2M4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJKTGN5XXIZLSL5UW64Y___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OjMzMGQ6OTYwMjRiYWE3NjMzOTFjZWM2MzNiZDRjOWM3NmVmOWM5Mzg5ODdkM2RjZTc5M2ZjMGUwMTY0NWJlM2YzODA3ZTpoOlQ6Tg> and Android<https://protect.checkpoint.com/v2/r02/___https://github.com/notifications/mobile/android/AIJZTNXISGMQCCQONYCB4LL5VQTKFA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZXHE3DMMRRHEY2M4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI___.YzJlOmlpYXNhOmM6bzowYjE3Mzk2NWRjYjYxMTA0M2IxOWY3NjUwYWRiMzUwYTo3OjU3MTI6NWVlNmEwNjlmNTMxN2I3MjNiZTQxNjVjMzIyNTA2ODc2OTRmYzIxN2YwM2FlMDk2NDVhNTcwMDlhZmM3ZDIwYjpoOlQ6Tg>. Download it today! You are receiving this because you commented.Message ID: ***@***.***>
9. jaapdeheer commented on Oct 25, 2026

   

   jaapdeheer

   on Oct 25, 2026

   More actions

   9. I actually discovered that it's possible I was getting this issue because my subscription downgraded to free version.

   Same here 🤦
   Not 100% sure the downgrade and the 400s were at the same time, but it seems likely. After resubscribing to a paid ChatGPT plan, it works again.

   Still, if possible, a clearer error would be very useful. Especially since OpenAI doesn't seem to send any kind of notification saying your subscription just ended (which is quite possibly days/weeks/months after you canceled renewal).
10. GWGWSEUI

    closed this as completedon Oct 25, 2026
11. krabishe commented on Oct 29, 2026

    

    krabishe

    on Oct 29, 2026

    More actions

    After updating OpenCode Desktop to 2.2.1 on Windows, every prompt in an existing session started failing with:

    Request failed: 400
    

    The affected connection used the OpenAI provider with ChatGPT OAuth (chatgpt-token-sharing). The selected model was openai/gpt-6.1-terra, variant max.

    The local server log recorded the error during connection authorization and model preparation:

    Integration.Authorization: Request failed: 400
    Integration.connection.resolve → ModelResolver.prepare
    

    This appears to happen before the model request is sent. The log did not include the response body or a more specific error code, so I can’t tell whether the cause was token refresh, an upstream response, or a regression in OpenCode.

    Workaround: Reconnecting the OpenAI account in OpenCode resolved the issue, and prompts work again.

    The same model had worked before the update. The timing suggests a possible connection to the update, but it does not establish causation. It would be helpful if OpenCode could surface a safe, more specific authorization error and prompt the user to reconnect when appropriate.