›_ Codex Issues
Codex Issues / #10989

Xcode Codex sign-in fails in Safari when HTTPS-only / HTTP warning blocks ⁠http://localhost callback (WebKitErrorDomain:305)

Open 💬 7 comments Opened Feb 7, 2026 by marlonjames71
💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

Environment:

  • macOS: Tahoe 26.2
  • Safari: 26.2 (21623.1.14.11.9)
  • Xcode: 26.3 Release Candidate
  • Sign-in method: Codex “Sign In” (not API key)

Issue:

The Codex sign-in flow in Xcode relies on a loopback redirect to a plain HTTP callback URL:

  • http://localhost:1455/auth/callback?...

On Safari 26.2, if the user has Safari → Settings → Advanced → “Warn before connecting to a website over HTTP” enabled (HTTPS-only behavior), Safari blocks that navigation and sign-in never completes. Safari reports:

  • "Navigation failed because the request was for an HTTP URL with HTTPS-Only enabled" (WebKitErrorDomain:305)

Repro steps (Xcode):

  1. Xcode → Settings… → Intelligence
  2. OpenAI → install Codex if needed
  3. Select Codex → More (… ) → Sign In (not “Use API Key”)
  4. Complete login in Safari window → click Continue
  5. Safari fails on ⁠http://localhost:1455/auth/callback?... and Xcode never completes sign-in

Expected:

Sign-in completes without requiring users to weaken Safari’s HTTP/HTTPS protections.

Suggested fixes:

  • Avoid dependence on ⁠http://localhost callbacks for this flow, e.g.:
  • custom URL scheme callback, or
  • universal link callback, or
  • device-code flow, or
  • localhost callback over HTTPS (if feasible).
  • At minimum: detect this failure mode and show an explicit, actionable error in Xcode such as:

“Safari blocked the localhost HTTP callback due to HTTPS-only/HTTP warning settings. Disable ‘Warn before connecting to a website over HTTP’ temporarily and try again.”

Workaround users found:

Uncheck Safari setting “Warn before connecting to a website over HTTP”, then retry sign-in.

View original on GitHub ↗

7 Comments

etraut-openai contributor · 5 months ago

If your system is configured to block localhost connections, then you'll need to use a different auth technique. Refer to our headless device auth documentation.

marlonjames71 · 5 months ago
If your system is configured to block localhost connections, then you'll need to use a different auth technique

In my report I mentioned in the workaround section that I just had to uncheck that setting. It works when you do that. I also can't control the auth technique in Xcode. That is all decided by Apple and potentially OpenAI. I have no control over that.

All that being said, this is a really bad user experience and it definitely wasn't clear to me that this is what had to be done in order for this to work. Part of this is on Apple as well I guess for not making it a bit clearer what that setting in Safari is doing. The title of that setting says "Warn". In this scenario it was full on blocking the callback URL.

I just wanted to bring this to OpenAI's attention in hopes that maybe there's a better auth process. I logged in with Claude earlier to see what this new Xcode integration is about and I had zero issues logging in. It was fast and very easy. Logging in with OpenAI was a different story that resulted in some lost hours.

gwl · 5 months ago

This is an abomination of a login architecture. If a user brought me the error message that Codex emits I'd suspect their system was infected with malware, not infected with a legitimate commercial software product.

eightythreeapps · 4 months ago

I have just come across this same issue and the workaround mentioned above did not work for me, the box was already unchecked. My solution? Download and use Firefox.

When Xcode launches you into the auth window, copy the address and complete the flow in Firefox instead and it all works as expected.

I had issues with Claude and the OAuth flow as well, Firefox fixed that too.

It's terrible UX and clearly was not tested properly before release.

d19dotca · 2 months ago

The workaround worked for me, but I just ran into this not even in Xcode but the new OpenAI Codex app itself, once I disabled the warning in Safari then it worked successfully.

ThomasHagenJohansen · 2 months ago

Don't work at my setup.
Xcode Version 26.5 (17F42)
Safari Version 26.5 (21624.2.5.11.4)
macOS Tahoe Version 26.5

aqoong · 1 month ago

<img width="837" height="235" alt="Image" src="https://github.com/user-attachments/assets/13aca0f9-cdda-4513-9522-e7a5d1471f7d" />

It works when you allow HTTP in Safari's security settings.
Uncheck the check box ✅