Repository navigation
Custom model provider that worked in 0.148 causes 401 in 0.150.1; removing model_provider = "def" fixes it. #40138
Description
What version of Codex CLI is running?
0.149.0-alpha.4.1
What subscription do you have?
Pro
Which model were you using?
5.6 Sol
What platform is your computer?
Darwin 25.5.0 arm64 arm
What terminal emulator and version are you using (if applicable)?
ChatGPT Desktop
Codex doctor report
{
"schemaVersion": 1,
"generatedAt": "1787423329s since unix epoch",
"overallStatus": "warning",
"codexVersion": "0.149.0-alpha.4.1",
"checks": {
"app_server.status": {
"id": "app_server.status",
"category": "app-server",
"status": "ok",
"summary": "background server is not running",
"details": {
"control socket": "/Users/dicrtarasov/.codex/app-server-control/app-server-control.sock",
"daemon state dir": "/Users/dicrtarasov/.codex/app-server-daemon",
"mode": "ephemeral",
"pid file": "/Users/dicrtarasov/.codex/app-server-daemon/app-server.pid (missing)",
"settings": "/Users/dicrtarasov/.codex/app-server-daemon/settings.json (missing)",
"status": "not running",
"update-loop pid file": "/Users/dicrtarasov/.codex/app-server-daemon/app-server-updater.pid (missing)"
},
"remediation": null,
"durationMs": 0
},
"auth.credentials": {
"id": "auth.credentials",
"category": "auth",
"status": "ok",
"summary": "OpenAI auth is not required for the active model provider",
"details": {
"auth file": "/Users/dicrtarasov/.codex/auth.json",
"auth storage mode": "File",
"model provider requires OpenAI auth": "false"
},
"remediation": null,
"durationMs": 0
},
"config.load": {
"id": "config.load",
"category": "config",
"status": "ok",
"summary": "config loaded",
"details": {
"CODEX_HOME": "/Users/dicrtarasov/.codex",
"config.toml": "/Users/dicrtarasov/.codex/config.toml",
"config.toml parse": "ok",
"cwd": "/Users/dicrtarasov/arcadia/adfox/ui/interfaces",
"enabled feature flags": "shell_tool, view_image, unified_exec, shell_snapshot, code_mode_host, terminal_resize_reflow, sqlite, memories, hooks, enable_request_compression, unbounded_connection_retries, multi_agent, apps, tool_search_always_defer_mcp_tools, tool_suggest, plugins, in_app_browser, in_app_chat, in_app_dictation, in_app_updates, browser_use, browser_use_full_cdp_access, remote_plugin, plugin_sharing, external_migration, image_generation, resize_all_images, item_ids, skill_mcp_dependency_install, skill_search, mentions_v2, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, auth_elicitation, personality, fast_mode, tui_app_server, prevent_idle_sleep, remote_compaction_v2, workspace_dependencies",
"feature flag overrides": "memories=true, browser_use_external=false, computer_use=false, external_migration=true, prevent_idle_sleep=true",
"feature flags enabled": "43",
"log dir": "/Users/dicrtarasov/.codex/log",
"mcp servers": "22",
"model": "gpt-5.6-sol",
"model provider": "def",
"sqlite home": "/Users/dicrtarasov/.codex"
},
"remediation": null,
"durationMs": 0
},
"desktop.app.version": {
"id": "desktop.app.version",
"category": "desktop",
"status": "ok",
"summary": "the desktop application is installed",
"details": {
"log directory": "$HOME/Library/Logs/com.openai.codex",
"running": "true",
"version": "26.818.41509"
},
"remediation": null,
"durationMs": 0
},
"desktop.app_server.handshake": {
"id": "desktop.app_server.handshake",
"category": "desktop",
"status": "ok",
"summary": "the desktop app-server initialized successfully",
"details": {},
"remediation": null,
"durationMs": 0
},
"desktop.security.enforcement": {
"id": "desktop.security.enforcement",
"category": "desktop",
"status": "ok",
"summary": "the desktop application passed available macos security assessments",
"details": {
"gatekeeper": "accepted"
},
"remediation": null,
"durationMs": 0
},
"git.environment": {
"id": "git.environment",
"category": "git",
"status": "warning",
"summary": "Git executable found but could not be run",
"details": {
".git entry": "directory",
"PATH git #1": "/usr/bin/git",
"PATH git entries": "1",
"repo detected": "true",
"repo root": "/Users/dicrtarasov",
"selected git": "/usr/bin/git"
},
"issues": [
{
"severity": "warning",
"cause": "Git executable was found on PATH but did not return a version",
"measured": null,
"expected": "git --version succeeds",
"remedy": "Fix the selected Git executable or PATH so Codex can inspect Git metadata.",
"fields": [
"git version",
"selected git"
]
}
],
"remediation": null,
"durationMs": 87
},
"installation": {
"id": "installation",
"category": "install",
"status": "ok",
"summary": "installation looks consistent",
"details": {
"PATH codex #1": "/Users/dicrtarasov/.local/bin/codex",
"PATH codex #2": "/Users/dicrtarasov/.local/bin/codex",
"PATH codex entries": "2",
"current executable": "/Applications/ChatGPT.app/Contents/Resources/codex",
"install context": "other",
"managed by bun": "false",
"managed by npm": "false",
"managed by pnpm": "false",
"managed package root": "not set"
},
"remediation": null,
"durationMs": 2
},
"mcp.config": {
"id": "mcp.config",
"category": "mcp",
"status": "ok",
"summary": "MCP configuration is locally consistent",
"details": {
"configured servers": "22",
"disabled servers": "1",
"stdio servers": "20",
"streamable_http servers": "2"
},
"remediation": null,
"durationMs": 16
},
"network.env": {
"id": "network.env",
"category": "network",
"status": "ok",
"summary": "network-related environment looks readable",
"details": {
"managed proxy": "not configured",
"proxy env vars": "none",
"respect system proxy": "disabled",
"system proxy": "direct"
},
"remediation": null,
"durationMs": 1
},
"network.provider_reachability": {
"id": "network.provider_reachability",
"category": "reachability",
"status": "ok",
"summary": "active provider has no HTTP endpoint to probe",
"details": {
"active provider endpoint": "none configured",
"desktop assets CDN": "https://chatgpt.com/backend-api/<redacted> reachable (HTTP 200)",
"reachability mode": "provider auth"
},
"remediation": null,
"durationMs": 0
},
"network.websocket_reachability": {
"id": "network.websocket_reachability",
"category": "websocket",
"status": "ok",
"summary": "Responses WebSocket is not enabled for the active provider",
"details": {
"model provider": "def",
"provider name": "OpenAI Data Residency",
"proxy env vars": "none",
"supports websockets": "false",
"wire API": "responses"
},
"remediation": null,
"durationMs": 0
},
"runtime.provenance": {
"id": "runtime.provenance",
"category": "runtime",
"status": "ok",
"summary": "running local build on macos-aarch64",
"details": {
"commit": "unknown",
"current executable": "/Applications/ChatGPT.app/Contents/Resources/codex",
"install method": "other",
"platform": "macos-aarch64",
"version": "0.149.0-alpha.4.1"
},
"remediation": null,
"durationMs": 0
},
"runtime.search": {
"id": "runtime.search",
"category": "search",
"status": "ok",
"summary": "search is OK (system)",
"details": {
"search command": "rg",
"search command readiness": "ripgrep 15.1.0",
"search provider": "system"
},
"remediation": null,
"durationMs": 37
},
"sandbox.helpers": {
"id": "sandbox.helpers",
"category": "sandbox",
"status": "ok",
"summary": "sandbox configuration is readable",
"details": {
"approval policy": "OnRequest",
"codex-linux-sandbox helper": "none",
"execve wrapper helper": "/Users/dicrtarasov/.codex/tmp/arg0/codex-arg0sw7Bsg/codex-execve-wrapper",
"filesystem sandbox": "restricted",
"network sandbox": "enabled"
},
"remediation": null,
"durationMs": 0
},
"security.endpoint": {
"id": "security.endpoint",
"category": "security",
"status": "ok",
"summary": "no supported endpoint protection detected",
"details": {
"endpoint products": "none detected"
},
"remediation": null,
"durationMs": 14
},
"state.paths": {
"id": "state.paths",
"category": "state",
"status": "ok",
"summary": "state paths and databases are inspectable",
"details": {
"CODEX_HOME": "/Users/dicrtarasov/.codex (dir)",
"active rollout files": "2149 files, 1937278317 total bytes, 901478 average bytes",
"archived rollout files": "52 files, 107665662 total bytes, 2070493 average bytes",
"goals DB": "/Users/dicrtarasov/.codex/goals_1.sqlite (file)",
"goals DB integrity": "ok",
"log DB": "/Users/dicrtarasov/.codex/logs_2.sqlite (file)",
"log DB integrity": "ok",
"log dir": "/Users/dicrtarasov/.codex/log (dir)",
"memories DB": "/Users/dicrtarasov/.codex/memories_1.sqlite (file)",
"memories DB integrity": "ok",
"queue DB": "/Users/dicrtarasov/.codex/queue_1.sqlite (file)",
"queue DB integrity": "ok",
"sqlite home": "/Users/dicrtarasov/.codex (dir)",
"state DB": "/Users/dicrtarasov/.codex/state_5.sqlite (file)",
"state DB integrity": "ok",
"thread history DB": "/Users/dicrtarasov/.codex/thread_history_1.sqlite (file)",
"thread history DB integrity": "ok"
},
"remediation": null,
"durationMs": 1980
},
"state.rollout_db_parity": {
"id": "state.rollout_db_parity",
"category": "threads",
"status": "ok",
"summary": "rollout files and state DB thread inventory agree",
"details": {
"default model provider": "def",
"rollout DB active files": "2149",
"rollout DB active rows": "2149",
"rollout DB archive mismatches": "0",
"rollout DB archived files": "52",
"rollout DB archived rows": "52",
"rollout DB duplicate DB paths": "0",
"rollout DB duplicate rollout thread ids": "0",
"rollout DB malformed file names": "0",
"rollout DB missing active rows": "0",
"rollout DB missing archived rows": "0",
"rollout DB model providers": "def=2124, openai=77",
"rollout DB rows": "2201",
"rollout DB scan cap reached": "false",
"rollout DB scan errors": "0",
"rollout DB sources": "exec=833, subagent:other=503, subagent:thread_spawn=440, vscode=399, cli=26",
"rollout DB stale rows": "0"
},
"remediation": null,
"durationMs": 812
},
"system.disk": {
"id": "system.disk",
"category": "disk",
"status": "ok",
"summary": "sufficient free disk space (468.9 GiB)",
"details": {
"CODEX_HOME available": "468.9 GiB",
"failure threshold": "1.0 GiB",
"warning threshold": "5.0 GiB",
"worktree available": "16384.0 GiB"
},
"remediation": null,
"durationMs": 0
},
"system.environment": {
"id": "system.environment",
"category": "system",
"status": "ok",
"summary": "OS language ru-RU",
"details": {
"EDITOR": "set",
"LANG": "ru_RU.UTF-8",
"LC_ALL": "ru_RU.UTF-8",
"LC_CTYPE": "ru_RU.UTF-8",
"VISUAL": "not set",
"os": "Mac OS 26.5.0 [64-bit]",
"os language": "ru-RU",
"os type": "Mac OS",
"os version": "26.5.0"
},
"remediation": null,
"durationMs": 3
},
"terminal.env": {
"id": "terminal.env",
"category": "terminal",
"status": "warning",
"summary": "height 12 rows - content may scroll off (recommended >=24)",
"details": {
"color output": "enabled",
"effective locale": "ru_RU.UTF-8",
"stderr is terminal": "true",
"stdin is terminal": "true",
"stdout is terminal": "true",
"terminal": "Apple Terminal",
"terminal size": "170x12"
},
"issues": [
{
"severity": "warning",
"cause": "height 12 rows - content may scroll off (recommended >=24)",
"measured": "170 x 12",
"expected": ">= 24 rows",
"remedy": "resize the window to at least 24 rows",
"fields": [
"terminal size"
]
}
],
"remediation": null,
"durationMs": 0
},
"terminal.title": {
"id": "terminal.title",
"category": "title",
"status": "ok",
"summary": "terminal title configured",
"details": {
"terminal title activity": "true",
"terminal title items": "activity, project-name, run-state, thread-title, model, task-progress",
"terminal title project source": "git repo root",
"terminal title project value": "dicrtarasov",
"terminal title source": "configured"
},
"remediation": null,
"durationMs": 0
},
"updates.status": {
"id": "updates.status",
"category": "updates",
"status": "ok",
"summary": "update configuration is locally consistent",
"details": {
"cached latest version": "0.149.0",
"check for update on startup": "true",
"last checked at": "2026-08-22T18:22:25.424841Z",
"latest version": "0.149.0",
"latest version status": "current version is not older",
"update action": "manual or unknown",
"version cache": "/Users/dicrtarasov/.codex/version.json"
},
"remediation": null,
"durationMs": 1025
}
}
}What issue are you seeing?
Summary
After updating the ChatGPT Desktop app on macOS, the bundled Codex CLI fails on every request with:
Unexpected status 401 Unauthorized: {"detail":"Unauthorized"},
url: https://chatgpt.com/backend-api/codex/responses
The issue is reproducible specifically with the Codex version bundled inside ChatGPT Desktop.
Replacing the bundled Codex binary with standalone Codex 0.148.0 immediately fixes the issue.
Environment
-
macOS, Apple Silicon
-
ChatGPT Desktop
-
ChatGPT Pro subscription
-
Authentication: Sign in with ChatGPT
-
No
OPENAI_*orCODEX_*environment variables -
codex login statusreports:Logged in using ChatGPT
Bundled Codex version:
/Applications/ChatGPT.app/Contents/Resources/codex --version
codex-cli 0.149.0-alpha.4.1
Standalone working version:
codex-cli 0.148.0
Actual behavior
Running the bundled binary directly:
/Applications/ChatGPT.app/Contents/Resources/codexand entering any prompt results in:
Reconnecting... 2/10
Unexpected status 401 Unauthorized: {"detail":"Unauthorized"},
url: https://chatgpt.com/backend-api/codex/responses
Example request ID:
01a02ab6-0c7a-71ea-a3fe-47b102e23d90
The same error occurs when using Codex through ChatGPT Desktop.
Expected behavior
The bundled Codex should authenticate and send requests successfully using the existing ChatGPT login.
Important reproduction detail
The exact same machine, account and authentication work correctly with Codex 0.148.0.
Available standalone releases:
0.146.0-aarch64-apple-darwin
0.148.0-aarch64-apple-darwin
0.149.0-aarch64-apple-darwin
Running:
~/.codex/packages/standalone/releases/0.148.0-aarch64-apple-darwin/bin/codexworks correctly.
Replacing:
/Applications/ChatGPT.app/Contents/Resources/codex
with the 0.148.0 binary also makes ChatGPT Desktop work correctly.
Restoring the bundled 0.149.0-alpha.4.1 reproduces the 401.
Previous ChatGPT Desktop build bundled:
codex-cli 0.149.0-alpha.4
and had the same problem.
After a later Desktop update it changed to:
codex-cli 0.149.0-alpha.4.1
but the issue remains.
Troubleshooting already performed
-
codex logout -
codex login -
Verified a new
~/.codex/auth.jsonwas created -
Verified:
codex login status Logged in using ChatGPT -
Verified:
env | grep -E 'OPENAI|CODEX'
returns nothing
-
Reproduced the failure by running the bundled Desktop binary directly
-
Verified standalone
0.148.0works with the same authentication
This strongly suggests a regression between Codex 0.148.0 and the 0.149.0-alpha.4.x builds bundled with ChatGPT Desktop.
Related issues:
- Codex Desktop keeps using revoked ChatGPT OAuth token after logout/login #31459
- Codex in Codex App giving 401 unauthorized #14915
What steps can reproduce the bug?
update 0.148 to 0.149.alpha4.1
What is the expected behavior?
No response
Additional information
No response
Activity
github-actions commentedon Aug 22, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
auth.json, causing 401 Unauthorized "Missing API key" #39857Powered by Codex Action
[-]401 Unauthorized after updating from 0.148.0 -> 0.149.0-alpha.4.1[/-][+]Custom model provider that worked in 0.148 causes 401 in 0.150.1; removing model_provider = "def" fixes it.[/+]kokoite commentedon Aug 30, 2026
I reproduced this independently and traced the 401 to the interaction between an implicit OpenAI endpoint and custom-provider authentication.
Reproduction
With
codex-cli 0.151.0, a custom provider like this reproduces the failure:The provider has no
base_url, so Codex routes it to the default OpenAI/ChatGPT endpoint. However,requires_openai_authdefaults tofalse. The request is consequently sent to/backend-api/codex/modelsand/backend-api/codex/responseswithout the existing Codex login credential and receives401 Unauthorized, even thoughcodex login statusis valid.Adding the following to the provider makes the same independent
codex execrequest succeed:Root cause
This behavior appears to be a consequence of the security change in #39214, which correctly prevents custom providers from inheriting ambient OpenAI credentials by default.
The conflicting paths are:
ModelProviderInfo::to_api_providerselects the default OpenAI/ChatGPT endpoint when a custom provider omitsbase_url.resolve_provider_authdeliberately returns unauthenticated auth for a custom provider whenrequires_openai_authis false and no provider-specific auth is configured.That security boundary should remain: Codex should not send ambient credentials to arbitrary third-party endpoints. The problematic case is specifically a provider with no explicit endpoint, which is routed to OpenAI but silently sent without credentials. The resulting remote 401 does not explain the configuration error.
Suggested behavior
Detect this combination locally and return an actionable configuration error:
base_url;requires_openai_authis false;Authorizationorx-openai-actor-authorizationheader is configured.The error can tell the user to set
requires_openai_auth = true, or configure an explicitbase_urland provider authentication. Providers with explicit endpoints, and providers with explicit auth headers, remain unchanged.I implemented that approach with regression tests as a reference here:
kokoite@91babf1
Verification on the current repository state:
just fmtjust test -p codex-model-provider— 77 tests passedjust fix -p codex-model-providerBecause this repository does not accept external pull requests, I am sharing the tested patch and analysis here for the maintainers.