codex login fails: Cloudflare challenge blocks CLI token exchange (Australia/Linux) #16052

Description

codex login and codex login --device-auth both fail with token_exchange_failed. Cloudflare's WAF is issuing a JavaScript challenge (cf-mitigated: challenge) on auth.openai.com, which the CLI's HTTP client cannot solve. This effectively makes the Codex CLI unusable without API key auth.

Error Messages

Browser OAuth flow:

Token exchange error: error sending request for url (https://auth.openai.com/oauth/token)
Error logging in: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

Device auth flow:

Error logging in with device code: error sending request for url (https://auth.openai.com/api/accounts/deviceauth/usercode)

Root Cause

curl -I https://auth.openai.com returns HTTP 403 with cf-mitigated: challenge — Cloudflare is serving a JavaScript challenge page ("Just a moment...") to non-browser clients. The Codex CLI's Rust HTTP client cannot solve this challenge, so the OAuth token exchange and device auth endpoints are unreachable.

HTTP/2 403
cf-mitigated: challenge
server: cloudflare

The browser OAuth redirect (step 1-3) works fine, but the server-to-server token exchange (step 4, CLI → auth.openai.com/oauth/token) is blocked by the challenge.

Environment

• CLI version: codex-cli 0.117.0
• OS: Arch Linux (kernel 6.19.6)
• Region: Melbourne, Australia (cf-ray: *-MEL)
• Install method: npm (~/.npm-global/bin/codex)

Reproduction

1. codex logout
2. codex login → fails with token_exchange_failed
3. codex login --device-auth → fails with same error
4. curl -I https://auth.openai.com → returns 403 with cf-mitigated: challenge

What I've ruled out

• Happens on multiple networks (home and office) — not network-specific
• Happens with Cloudflare WARP stopped (sudo systemctl stop warp-svc)
• Happens with Tailscale down (sudo tailscale down)
• Happens with no proxy env vars set
• Happens on both IPv4 and IPv6
• TLS handshake completes successfully (TLSv1.3 / TLS_AES_256_GCM_SHA384)
• curl https://chatgpt.com/backend-api/codex/responses returns {"detail":"Method Not Allowed"} — so chatgpt.com endpoints are reachable

Expected Behavior

The CLI should be able to complete the OAuth token exchange without being blocked by Cloudflare's bot mitigation. Either:

• The WAF rules on auth.openai.com should allowlist the Codex CLI's user-agent/request pattern, or
• The CLI should handle Cloudflare challenges gracefully (e.g., falling back to device auth or providing clear guidance)