Bug Description
The openai-codex provider fails on all models (gpt-5.4, gpt-5.3-codex, gpt-5.2) since approximately version 2026.4.5. Two stacked issues prevent any request from completing.
Environment
- OpenClaw version: 2026.4.12 (also tested on 2026.4.14)
- Container:
ghcr.io/openclaw/openclaw:latest
- Platform: Docker on macOS (Colima), arm64
- Auth method: Codex CLI OAuth (
openclaw onboard --auth-choice openai-codex)
- OpenAI subscription: Pro ($200/mo)
Issue 1: Cloudflare JS Challenge (HTTP 403)
The openai-codex provider uses a hardcoded native route (route=native policy=hidden) that hits chatgpt.com/backend-api. Cloudflare returns a JS challenge that headless containers cannot solve:
HTTP/2 403
cf-mitigated: challenge
Container logs show:
embedded run agent end: isError=true model=gpt-5.4 provider=openai-codex
error=LLM request failed: DNS lookup for the provider endpoint failed.
rawError=<html>...(Cloudflare challenge page)...
The error message "DNS lookup failed" is misleading — DNS resolves fine, the issue is Cloudflare returning HTML instead of JSON.
Tested from both container and host — same 403 with cf-mitigated: challenge on all paths:
curl https://chatgpt.com/backend-api/codex/v1/responses → 403- Both with and without Bearer token
Issue 2: Missing api.responses.write OAuth Scope
The Codex CLI OAuth client (app_EMoamEEZ73f0CkXaXp7hrann) requests scopes: openid profile email offline_access api.connectors.read api.connectors.invoke. It does NOT include api.responses.write.
When testing the token directly against api.openai.com/v1/responses:
{
"error": {
"message": "Missing scopes: api.responses.write"
}
}Re-authing via openclaw onboard --auth-choice openai-codex issues a fresh token with the same limited scopes.
What We Tried (All Failed)
- Revoking OpenClaw consent in OpenAI connected apps settings, then re-authing
- Running
openclaw onboard --auth-choice openai-codex (fresh token, same scopes)
- Upgrading Codex CLI from 0.104.0 to 0.120.0
- Pinning to
openai-codex/gpt-5.3-codex (same Cloudflare block)
- Using the
codex/gpt-5.4 provider prefix (separate provider entry in models.json, also fails)
- Overriding
baseUrl in models.json — the native route (policy=hidden) ignores it
Additional Issue: openclaw onboard Wipes Auth
Running openclaw onboard --auth-choice openai-codex empties agents/main/agent/auth.json (0 bytes). This causes ALL providers to lose authentication until the container is fully restarted with environment variables re-injected. This feels like a separate bug.
Expected Behavior
The openai-codex provider should route requests to the ChatGPT backend API in a way that either:
- Bypasses Cloudflare challenges (as the Codex CLI itself does)
- Or uses the public API (
api.openai.com/v1/responses) with proper OAuth scopes including api.responses.write
Workaround
Using anthropic/claude-haiku-4-5-20251001 as primary model with direct Anthropic API key. This works reliably but doesn't use the OpenAI Pro subscription.
Reproduction Steps
- Deploy OpenClaw 2026.4.12+ in Docker
- Run
openclaw onboard --auth-choice openai-codex and complete the OAuth flow
- Set primary model to
openai-codex/gpt-5.4
- Send any message
- Observe Cloudflare 403 in container logs with
cf-mitigated: challenge
Bug Description
The
openai-codexprovider fails on all models (gpt-5.4, gpt-5.3-codex, gpt-5.2) since approximately version 2026.4.5. Two stacked issues prevent any request from completing.Environment
ghcr.io/openclaw/openclaw:latestopenclaw onboard --auth-choice openai-codex)Issue 1: Cloudflare JS Challenge (HTTP 403)
The
openai-codexprovider uses a hardcoded native route (route=native policy=hidden) that hitschatgpt.com/backend-api. Cloudflare returns a JS challenge that headless containers cannot solve:Container logs show:
The error message "DNS lookup failed" is misleading — DNS resolves fine, the issue is Cloudflare returning HTML instead of JSON.
Tested from both container and host — same 403 with
cf-mitigated: challengeon all paths:curl https://chatgpt.com/backend-api/codex/v1/responses→ 403Issue 2: Missing
api.responses.writeOAuth ScopeThe Codex CLI OAuth client (
app_EMoamEEZ73f0CkXaXp7hrann) requests scopes:openid profile email offline_access api.connectors.read api.connectors.invoke. It does NOT includeapi.responses.write.When testing the token directly against
api.openai.com/v1/responses:{ "error": { "message": "Missing scopes: api.responses.write" } }Re-authing via
openclaw onboard --auth-choice openai-codexissues a fresh token with the same limited scopes.What We Tried (All Failed)
openclaw onboard --auth-choice openai-codex(fresh token, same scopes)openai-codex/gpt-5.3-codex(same Cloudflare block)codex/gpt-5.4provider prefix (separate provider entry in models.json, also fails)baseUrlinmodels.json— the native route (policy=hidden) ignores itAdditional Issue:
openclaw onboardWipes AuthRunning
openclaw onboard --auth-choice openai-codexemptiesagents/main/agent/auth.json(0 bytes). This causes ALL providers to lose authentication until the container is fully restarted with environment variables re-injected. This feels like a separate bug.Expected Behavior
The
openai-codexprovider should route requests to the ChatGPT backend API in a way that either:api.openai.com/v1/responses) with proper OAuth scopes includingapi.responses.writeWorkaround
Using
anthropic/claude-haiku-4-5-20251001as primary model with direct Anthropic API key. This works reliably but doesn't use the OpenAI Pro subscription.Reproduction Steps
openclaw onboard --auth-choice openai-codexand complete the OAuth flowopenai-codex/gpt-5.4cf-mitigated: challenge