›_ Codex Issues
Codex Issues / #1842

Azure OpenAI Returns 401 Unauthorized After Upgrading to Codex 0.12.0

Resolved 💬 9 comments Opened Aug 5, 2025 by dustookk Closed Aug 8, 2025
💡 Likely answer: A maintainer (bolinfest, collaborator) responded on this thread — see the highlighted reply below.

What version of Codex is running?

0.12.0

Which model were you using?

gpt-4.1

What platform is your computer?

Darwin 24.5.0 arm64 arm

What steps can reproduce the bug?

Everything worked perfectly with version 0.10.0. However, after upgrading Codex to 0.12.0, the authorization stopped functioning. I now receive the following error:

stream error: unexpected status 401 Unauthorized: {\"error\":{\"code\":\"401\",\"message\":\"Access denied due to invalid subscription key or wrong API endpoint. Make sure to provide a valid key for an active subscription and use a correct regional API endpoint for your resource.\"}}; retrying 1/10 in 202m

What is the expected behavior?

_No response_

What do you see instead?

<img width="2842" height="1654" alt="Image" src="https://github.com/user-attachments/assets/152d7ffa-d08f-4167-b231-ef0592462c7a" />

Additional information

I inspected the http package and discovered that the authorization key being used isn’t the one I configured in my .bash_profile. I believe the issue originates from this discrepancy.

<img width="2162" height="1196" alt="Image" src="https://github.com/user-attachments/assets/1f66ae4f-2a02-4b34-8645-9f6207f5d6ae" />

View original on GitHub ↗

9 Comments

blrchen · 11 months ago

From my end, only models that use responses API like codex-mini seem to be affected. Models that use chat completion API, such as GPT-4.1 and o4-mini, are working fine.

bolinfest collaborator · 11 months ago

Are you storing environment variables in an .env folder, by chance?

dustookk · 11 months ago

@bolinfest

The key AZURE_OPENAI_API_KEY is stored in my .bash_profile

The other configuration settings are in .codex/config.toml

kingdomseed · 11 months ago

I'm having the same issue. Stored the key in zshrc.

github-actions[bot] contributor · 11 months ago

Implemented fix for Azure OpenAI 401 error.

Key points:
• Root cause: Codex 0.12.0 always sent “Authorization: Bearer <key>”.
Azure OpenAI requires “api-key: <key>”, so requests were rejected.
• Update: codex-rs/core/src/model_provider_info.rs
– create_request_builder now detects Azure endpoints ( *.openai.azure.com ).
– For those endpoints, when using an ApiKey it sets header “api-key” instead of Bearer auth.
– Other providers retain existing behaviour.

Core crate compiles cleanly after change.

This restores proper authentication for Azure OpenAI while leaving all other providers unaffected.

---
Opened pull request: https://github.com/openai/codex/pull/1890

---
_View workflow run_

bolinfest collaborator · 11 months ago

Can you see if this is fixed in 0.15.0 (or later): https://github.com/openai/codex/releases/tag/rust-v0.15.0

I believe https://github.com/openai/codex/pull/1861 is the fix?

cbagwellfnc · 11 months ago

I tested with v0.16.0 and I am still seeing authorization: Bearer being sent to Azure with gpt-4o model and chat/completions and resulting in failed auth.

cbagwellfnc · 11 months ago

Re-reading this thread, #1861 may have fixed the original issue as described. My response that it's not fixed is more related to the automated issue mentioned in this thread and by PR #1890 which is an issue that I'm seeing but not likely the original issue.

dustookk · 11 months ago

@bolinfest , It is fixed in 0.19.0 Thanks