Skip to content

0.149.0: Auth headers not sent — 401 Unauthorized in ChatGPT login mode (worked in 0.148.0) #39883

Closed
Closed
0.149.0: Auth headers not sent — 401 Unauthorized in ChatGPT login mode (worked in 0.148.0)#39883
Labels
CLIIssues related to the Codex CLIauthIssues related to authentication and accountsbugSomething isn't working

Description

@kailiangshang
kailiangshang
opened on Aug 21, 2026

What version of Codex CLI is running?

0.149.0

What subscription do you have?

pro

Which model were you using?

No response

What platform is your computer?

linux

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report



What issue are you seeing?


Body:


Summary


After upgrading codex-cli from 0.148.0 to 0.149.0, all requests fail with 401 Unauthorized when using ChatGPT login auth. Downgrading to 0.148.0 with the exact same auth.json, config, and network immediately fixes it. Evidence suggests 0.149.0 does not attach auth headers to requests.


Environment


    

  • codex-cli 0.149.0 (installed via npm, linux-x64)
    • 

  • Auth mode: ChatGPT login (codex login status → "Logged in using ChatGPT")
    • 

  • Config: model_provider = "codex", wire_api = "responses" (default built-in provider)
    • 



Symptom 1: ChatGPT backend returns 401


ERROR: unexpected status 401 Unauthorized: {"detail":"Unauthorized"},
url: https://chatgpt.com/backend-api/codex/responses



Retries 5 times (also refreshes token via auth.openai.com in between) and fails.


Symptom 2: with CODEX_API_KEY set, no Authorization header at all


With CODEX_API_KEY exported, 0.149.0 routes requests to api.openai.com but the server responds:


401 Unauthorized: Missing bearer or basic authentication in header



i.e. no Authorization header was sent. On 0.148.0 with the same env var, the key IS sent (server returns invalid_api_key for my third-party relay key instead, proving the header exists in 0.148.0).


Evidence this is a client-side regression, not account/network


    

  1. 

    Direct curl with the same access token from the same machine/network passes auth:
    

    curl -X POST https://chatgpt.com/backend-api/codex/responses \
  -H "Authorization: Bearer <access_token from auth.json>" \
  -H "chatgpt-account-id: <account_id>" \
  -d '{"model":"gpt-5.6-sol","input":[...]}'
# → HTTP 400 {"detail":"Store must be set to false"}  (auth OK, request-shape complaint)
    

    2. 

  2. 

    Control test — omitting the Authorization header entirely reproduces the exact error:
    

    curl -X POST https://chatgpt.com/backend-api/codex/responses -d '{...}'
# → HTTP 401 {"detail":"Unauthorized"}   ← identical to codex 0.149.0's error
    

    3. 

  3. 

    Token is valid (JWT exp ~10 days out, refreshed today), plan = Pro.
    

    4. 

  4. 

    Colleagues on the same shared machine and same network egress run older versions without issues.
    

    5. 

  5. 

    Downgrade to 0.148.0 (no other changes) → everything works again.
    

    6. 



What steps can reproduce the bug?


Repro


    

  1. npm i -g @openai/codex@0.149.0
    2. 

  2. codex login (ChatGPT mode)
    3. 

  3. codex exec "say OK" → 401 {"detail":"Unauthorized"} from chatgpt.com/backend-api/codex/responses
    4. 



Possibly relevant debug-log fields observed in 0.149.0: auth_credentials_store_mode: File, keyring_backend_kind: Direct, enable_codex_api_key_env: true.


What is the expected behavior?


No response


Additional information


No response
Activity
  1. kailiangshang
    added 
    bugSomething isn't working
     on Aug 21, 2026
  2. github-actions
    added 
    CLIIssues related to the Codex CLI
     
    authIssues related to authentication and accounts
     on Aug 21, 2026
  3. github-actions commented on Aug 21, 2026 
    @github-actions
    github-actionsBot
    on Aug 21, 2026 – with GitHub Actions
    Contributor
    Potential duplicates detected. Please review them and close your issue if it is a duplicate.
    


    Powered by Codex Action
  4. Grallen commented on Aug 22, 2026 
    @Grallen
    Grallen
    on Aug 22, 2026
    This report is thorough.  I am just posting the command to downgrade for those that wander by: npm install -g @openai/codex@0.148.0
  5. kailiangshang commented on Aug 22, 2026 
    @kailiangshang
    kailiangshang
    on Aug 22, 2026
    Author
    

    This report is thorough. I am just posting the command to downgrade for those that wander by: npm install -g @openai/codex@0.148.0
    

    

    @Grallen Thanks for sharing the workaround!
    
Since this issue describes the same "401 Unauthorized / missing API key" problem caused by the 0.149.0 update as reported in #39857 and #39820, I'm going to close this as a duplicate. We can track the progress and wait for the official patch in those threads.
  6. kailiangshang
    closed this as completedon Aug 22, 2026
  7. Joshuaalbert commented on Sep 25, 2026 
    @Joshuaalbert
    Joshuaalbert
    on Sep 25, 2026
    Receiving this on 157.0 that seems related. It blocks codex completely.
    

    ⚠ Falling back from WebSockets to HTTPS transport. stream disconnected before completion: websocket closed by server before response.completed

■ unexpected status 401 Unauthorized: Incorrect API key provided:
sk-svcac***********************************************************************************************************************************************************fvMA. You can find
your API key at https://platform.openai.com/account/api-keys., url: https://chatgpt.com/backend-api/codex/responses, cf-ray: a40dbd8ef94ebccf-AMS, request id:
809a492b-8554-4ce8-8a23-247082b1b06b

  8. kailiangshang commented on Sep 25, 2026 
    @kailiangshang
    kailiangshang
    on Sep 25, 2026
    Author
    

    Receiving this on 157.0 that seems related. It blocks codex completely.
    

    ⚠ Falling back from WebSockets to HTTPS transport. stream disconnected before completion: websocket closed by server before response.completed

■ unexpected status 401 Unauthorized: Incorrect API key provided:
sk-svcac***********************************************************************************************************************************************************fvMA. You can find
your API key at https://platform.openai.com/account/api-keys., url: https://chatgpt.com/backend-api/codex/responses, cf-ray: a40dbd8ef94ebccf-AMS, request id:
809a492b-8554-4ce8-8a23-247082b1b06b

    

    

    When you do the update, take a moment to check your config file. There's a parameter field in there — if you still keep the old naming convention from a previous version, you'll keep running into the same error even after upgrading to the latest version. I can't remember the exact parameter off the top of my head, but I think it's the model provider one. In one of Codex's later updates that parameter was renamed / replaced with a different one, and if your config still uses the outdated key it keeps triggering the issue repeatedly. So the real fix is to update that field to match the current schema, not just bump the version.
  9. kailiangshang commented on Sep 25, 2026 
    @kailiangshang
    kailiangshang
    on Sep 25, 2026
    Author
    

    Receiving this on 157.0 that seems related. It blocks codex completely.
    

    ⚠ Falling back from WebSockets to HTTPS transport. stream disconnected before completion: websocket closed by server before response.completed

■ unexpected status 401 Unauthorized: Incorrect API key provided:
sk-svcac***********************************************************************************************************************************************************fvMA. You can find
your API key at https://platform.openai.com/account/api-keys., url: https://chatgpt.com/backend-api/codex/responses, cf-ray: a40dbd8ef94ebccf-AMS, request id:
809a492b-8554-4ce8-8a23-247082b1b06b

    

    

    When you do the update, take a moment to check your config.toml file. There's a specific parameter field that often causes this — if you keep the old naming convention from a previous version, you'll keep running into the same error even after upgrading to the latest version.
    

    Specifically, check the model_provider and wire_api parameters. In Codex versions after 0.149.0, the authentication logic changed. The wire_api parameter must now be set to "responses" (the old "chat" value is no longer supported). Additionally, if you are using an official OpenAI account, ensure requires_openai_auth is set to true.
    

    If your config still uses the outdated keys, it keeps triggering the 401 Unauthorized error repeatedly. So the real fix is to update that field to match the current schema, not just bump the version.
    

    Also, regarding the Falling back from WebSockets to HTTPS warning: if your proxy environment doesn't support WebSocket forwarding, you can add supports_websockets = false to your config to skip the retry attempts and speed up the startup.
    

    

    💡 Optional Addition:
    
If you want to offer them a direct solution, you can append this:
    

    

    Here is what the updated config block should look like for an official account:
    

    model_provider = "openai_http"
[model_providers.openai_http]
wire_api = "responses"
requires_openai_auth = true
supports_websockets = false
    

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Metadata
Metadata
Assignees
No one assigned
    Labels
    CLIIssues related to the Codex CLIauthIssues related to authentication and accountsbugSomething isn't working
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions