Token exchange failed: token endpoint returned status 403 Forbidden

Token exchange failed: token endpoint returned status 403 Forbidden

same problem

The codex CLI starts a local OAuth callback server on http://localhost:<port> inside WSL.
When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:<port>.

Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to:

Firewall or antivirus blocking the loopback traffic,

IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1),

Or because the login was performed entirely on the Windows side while the server is only listening inside WSL.

As a result, authentication cannot complete.

Solution:

In PowerShell on Windows, install and log in:

npm install -g @openai/codex
codex

Complete the login in the Windows browser.

After login, Windows stores credentials at:

C:\Users\<YourName>\.codex\auth.json

Copy this file into WSL:

mkdir -p ~/.codex
cp /mnt/c/Users/<YourName>/.codex/auth.json ~/.codex/auth.json

Now codex in WSL is authenticated without needing to repeat the browser flow.

The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: Firewall or antivirus blocking the loopback traffic, IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. As a result, authentication cannot complete. Solution: In PowerShell on Windows, install and log in: npm install -g @openai/codex codex Complete the login in the Windows browser. After login, Windows stores credentials at: C:\Users<YourName>.codex\auth.json Copy this file into WSL: mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json Now codex in WSL is authenticated without needing to repeat the browser flow.

$HIT,this works, either you are openai employee or you're a genius

<img width="1525" height="482" alt="Image" src="https://github.com/user-attachments/assets/058acb6d-6435-42bd-981e-e039db4019f4" />
设置localhost 与 127.0.0.1不经过代理就可以了

The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: Firewall or antivirus blocking the loopback traffic, IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. As a result, authentication cannot complete. Solution: In PowerShell on Windows, install and log in: npm install -g @openai/codex codex Complete the login in the Windows browser. After login, Windows stores credentials at: C:\Users<YourName>.codex\auth.json Copy this file into WSL: mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json Now codex in WSL is authenticated without needing to repeat the browser flow.

This worked for me^

`` brew install codex``
didn^t work so i used the above commands.

The codex CLI starts a local OAuth callback server on http://localhost: inside WSL.codex CLI 在 WSL 内部的 http://localhost 上启动本地 OAuth 回调服务器。 When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:.当您在 Windows 浏览器中打开登录链接时，浏览器会尝试重定向回 http://localhost :。 Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to:正常情况下，Windows → WSL 的 localhost 端口转发功能正常，因此回调应该能够到达 WSL 内部的服务器。然而，在某些设置下，由于以下原因，此操作会失败： Firewall or antivirus blocking the loopback traffic,防火墙或防病毒软件阻止了环回流量， IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1),IPv6 与 IPv4 解析问题（localhost 与 127.0.0.1）， Or because the login was performed entirely on the Windows side while the server is only listening inside WSL.或者因为登录完全在 Windows 端执行，而服务器仅在 WSL 内部进行监听。 As a result, authentication cannot complete.因此，身份验证无法完成。 Solution:  解决方案： In PowerShell on Windows, install and log in:在 Windows 上的 PowerShell 中，安装并登录： npm install -g @openai/codex codex  法典 Complete the login in the Windows browser.在 Windows 浏览器中完成登录。 After login, Windows stores credentials at:登录后，Windows 会将凭据存储在： C:\Users<YourName>.codex\auth.jsonC:\用户 <YourName>.codex\auth.json Copy this file into WSL:将此文件复制到 WSL 中： mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.jsoncp /mnt/c/用户//.codex/auth.json ~/.codex/auth.json Now codex in WSL is authenticated without needing to repeat the browser flow.现在 WSL 中的 codex 已通过身份验证，无需重复浏览器流程。

you're a genius bro! thanks

The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: Firewall or antivirus blocking the loopback traffic, IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. As a result, authentication cannot complete. Solution: In PowerShell on Windows, install and log in: npm install -g @openai/codex codex Complete the login in the Windows browser. After login, Windows stores credentials at: C:\Users<YourName>.codex\auth.json Copy this file into WSL: mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json Now codex in WSL is authenticated without needing to repeat the browser flow.

Thanks for the clear write-up—super helpful. I ran into the same issue, and here’s what worked for me on macOS:

1. Install Codex CLI on macOS

# If Node isn’t installed yet:
brew install node

# Install Codex CLI
npm install -g @openai/codex

2. Trigger the login and finish it in your macOS browser

codex

3. Verify the credentials file exists

ls -la ~/.codex
cat ~/.codex/auth.json

4. Copy the credentials to your remote Linux machine

# Prepare the target directory and permissions on the remote host
ssh ubuntu@YOUR_SERVER 'mkdir -p ~/.codex && chmod 700 ~/.codex'

# Copy from macOS to the remote host
scp ~/.codex/auth.json ubuntu@YOUR_SERVER:~/.codex/auth.json

# (Optional) Tighten file permissions on the remote host
ssh ubuntu@YOUR_SERVER 'chmod 600 ~/.codex/auth.json'

After this, running codex on the remote host should work without repeating the browser OAuth flow.

> The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. > Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: > Firewall or antivirus blocking the loopback traffic, > IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), > Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. > As a result, authentication cannot complete. > Solution: > In PowerShell on Windows, install and log in: > npm install -g @openai/codex codex > Complete the login in the Windows browser. > After login, Windows stores credentials at: > C:\Users.codex\auth.json > Copy this file into WSL: > mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json > Now codex in WSL is authenticated without needing to repeat the browser flow. Thanks for the clear write-up—super helpful. I ran into the same issue, and here’s what worked for me on macOS: ## 1. Install Codex CLI on macOS # If Node isn’t installed yet: brew install node # Install Codex CLI npm install -g @openai/codex ## 2. Trigger the login and finish it in your macOS browser codex ## 3. Verify the credentials file exists ls -la ~/.codex cat ~/.codex/auth.json ## 4. Copy the credentials to your remote Linux machine # Prepare the target directory and permissions on the remote host ssh ubuntu@YOUR_SERVER 'mkdir -p ~/.codex && chmod 700 ~/.codex' # Copy from macOS to the remote host scp ~/.codex/auth.json ubuntu@YOUR_SERVER:~/.codex/auth.json # (Optional) Tighten file permissions on the remote host ssh ubuntu@YOUR_SERVER 'chmod 600 ~/.codex/auth.json' After this, running codex on the remote host should work without repeating the browser OAuth flow.

thank you

Thanks @Hanminghao. Can I change the default location ~/.codex on the server?

however, I can't login opanAI in macOS browser. when I login, browser return 'Token exchange failed: token endpoint returned status 403 Forbidden'. Is this related to my VPN?

however, I can't login opanAI in macOS browser. when I login, browser return 'Token exchange failed: token endpoint returned status 403 Forbidden'. Is this related to my VPN?

I have resolved the issue. It was indeed caused by the VPN. My terminal wasn't using the VPN and required a manual proxy setup.

> however, I can't login opanAI in macOS browser. when I login, browser return 'Token exchange failed: token endpoint returned status 403 Forbidden'. Is this related to my VPN? I have resolved the issue. It was indeed caused by the VPN. My terminal wasn't using the VPN and required a manual proxy setup.

Bro, I am confused about the "terminal". Why your browser warning and you say the problem is in terminal?

<img alt="Image" width="1525" height="482" src="https://private-user-images.githubusercontent.com/887531/481345989-058acb6d-6435-42bd-981e-e039db4019f4.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NTgwMTYyNDgsIm5iZiI6MTc1ODAxNTk0OCwicGF0aCI6Ii84ODc1MzEvNDgxMzQ1OTg5LTA1OGFjYjZkLTY0MzUtNDJiZC05ODFlLWUwMzlkYjQwMTlmNC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjUwOTE2JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI1MDkxNlQwOTQ1NDhaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0yYmE1OTFiODlkYjdiODg1YTVkN2U3NGNkNzQ3OTZiNDA5NTBkYTBkNDgzNTBiYzY5ZmEwYjI3YTY5YjNjM2E1JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCJ9.0HA_D6cjBKdfRMOOmX-2Az4u8ftw4-LX8RLEz4WcFrI"> 设置localhost 与 127.0.0.1不经过代理就可以了

老哥，这是在流程的哪一部分设置的？

I'm having this issue on Ubuntu 24.04, has anyone run into this before?

Try setting a proxy for your terminal and then run the codex authentication flow.

You can add the following helper function to your .zshrc or .bashrc:

proxy() {
  local cmd="$1"
  shift

  local default_addr="http://127.0.0.1:9527"
  local proxy_addr="${1:-$default_addr}"
  local ssh_config="$HOME/.ssh/config"

  case "$cmd" in
    set)
      export http_proxy="$proxy_addr"
      export https_proxy="$proxy_addr"
      export all_proxy="socks5://127.0.0.1:9527"

      git config --global http.proxy "$proxy_addr"
      git config --global https.proxy "$proxy_addr"

      mkdir -p "$HOME/.ssh"

      if ! grep -q "ProxyJump 127.0.0.1:9527" "$ssh_config" 2>/dev/null; then
        {
          echo ""
          echo "Host *"
          echo "  ProxyJump 127.0.0.1:9527"
        } >> "$ssh_config"
      fi
      ;;

    unset)
      unset http_proxy
      unset https_proxy
      unset all_proxy

      git config --global --unset http.proxy
      git config --global --unset https.proxy

      if [[ -f "$ssh_config" ]]; then
        sed -i '' '/ProxyJump 127.0.0.1:9527/d' "$ssh_config"
        sed -i '' '/Host \*/d' "$ssh_config"
      fi
      ;;

    *)
      echo "Usage:"
      echo "  proxy set [proxy_address]"
      echo "  proxy unset"
      ;;
  esac
}

Note: Git/SSH proxy is not required for codex login. I include them in my personal helper below—feel free to remove those lines if you don’t need them. ⚠️ Script only tested on macOS, sed -i '' syntax may differ on Linux

Reload your shell config:

source ~/.zshrc   # or source ~/.bashrc

Enable proxy before running auth flow

proxy set

(Yep, you can also pass a custom proxy address, e.g. proxy set http://127.0.0.1:1080)

Run the codex and go login, after finishing you can unset the proxy:

proxy unset

I'm able to login via copy and pasting the AUTH file over from Windows, but the conversation still could not be established with OpenAI server. The error message I'm getting after sending prompt is: "stream error: error sending request for url (https://chatgpt.com/backend-api/codex/responses)"

Try setting a proxy for your terminal and then run the codex authentication flow. You can add the following helper function to your .zshrc or .bashrc: proxy() { local cmd="$1" shift local default_addr="http://127.0.0.1:9527" local proxy_addr="${1:-$default_addr}" local ssh_config="$HOME/.ssh/config" case "$cmd" in set) export http_proxy="$proxy_addr" export https_proxy="$proxy_addr" export all_proxy="socks5://127.0.0.1:9527" git config --global http.proxy "$proxy_addr" git config --global https.proxy "$proxy_addr" mkdir -p "$HOME/.ssh" if ! grep -q "ProxyJump 127.0.0.1:9527" "$ssh_config" 2>/dev/null; then { echo "" echo "Host " echo " ProxyJump 127.0.0.1:9527" } >> "$ssh_config" fi ;; unset) unset http_proxy unset https_proxy unset all_proxy git config --global --unset http.proxy git config --global --unset https.proxy if [[ -f "$ssh_config" ]]; then sed -i '' '/ProxyJump 127.0.0.1:9527/d' "$ssh_config" sed -i '' '/Host \/d' "$ssh_config" fi ;; *) echo "Usage:" echo " proxy set [proxy_address]" echo " proxy unset" ;; esac } > Note: Git/SSH proxy is not required for codex login. I include them in my personal helper below—feel free to remove those lines if you don’t need them. > ⚠️ Script only tested on macOS, sed -i '' syntax may differ on Linux Reload your shell config: source ~/.zshrc # or source ~/.bashrc Enable proxy before running auth flow proxy set (Yep, you can also pass a custom proxy address, e.g. proxy set http://127.0.0.1:1080) Run the codex and go login, after finishing you can unset the proxy: proxy unset

Thanks for the help! I tried the script but it returns error sending request message, maybe I did something wrong?

Thank you. It works For me.

---Original---
From: @.*&gt;
Date: Fri, Sep 19, 2025 11:47 AM
To: @.*&gt;;
Cc: "Yuanze @.****@.**&gt;;
Subject: Re: [openai/codex] Token exchange failed: token endpoint returnedstatus 403 Forbidden (Issue #2414)

luckyJeffy left a comment (openai/codex#2414)

Try setting a proxy for your terminal and then run the codex authentication flow.

You can add the following helper function to your .zshrc or .bashrc:
proxy() { local cmd="$1" shift local default_addr="http://127.0.0.1:9527" local proxy_addr="${1:-$default_addr}" local ssh_config="$HOME/.ssh/config" case "$cmd" in set) export http_proxy="$proxy_addr" export https_proxy="$proxy_addr" export all_proxy="socks5://127.0.0.1:9527" git config --global http.proxy "$proxy_addr" git config --global https.proxy "$proxy_addr" mkdir -p "$HOME/.ssh" if ! grep -q "ProxyJump 127.0.0.1:9527" "$ssh_config" 2&gt;/dev/null; then { echo "" echo "Host " echo " ProxyJump 127.0.0.1:9527" } &gt;&gt; "$ssh_config" fi ;; unset) unset http_proxy unset https_proxy unset all_proxy git config --global --unset http.proxy git config --global --unset https.proxy if [[ -f "$ssh_config" ]]; then sed -i '' '/ProxyJump 127.0.0.1:9627/d' "$ssh_config" sed -i '' '/Host \/d' "$ssh_config" fi ;; *) echo "Usage:" echo " proxy set [proxy_address]" echo " proxy unset" ;; esac }

Note: Git/SSH proxy is not required for codex login. I include them in my personal helper below—feel free to remove those lines if you don’t need them.
⚠️ Script only tested on macOS, sed -i '' syntax may differ on Linux

Reload your shell config:
source ~/.zshrc # or source ~/.bashrc

Enable proxy before running auth flow
proxy set

(Yep, you can also pass a custom proxy address, e.g. proxy set http://127.0.0.1:1080)

Run the codex and go login, after finishing you can unset the proxy:
proxy unset

—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.Message ID: @.***&gt;

I tried the script but it returns error sending request message, maybe I did something wrong?

Hi @muye1202 , could you paste the full error message here so we can take a closer look?
Before running the script, please also verify that your proxy server is up and reachable, and that the address/port in the script matches your setup.

When on Windows:

FAIL mode
Using git bash to sign in fails with the same localhost:PORT/auth/bla

SUCCESS mode
Install codex through git bash, BUT _during the log in process_ use the regular Command Prompt:
codex -> Sign in with ChatGPT -> run though login -> Great Success!

Just bumped into the issue myself, tried a few times until realized that using windows standard tools would work better and it did.

I'm having this issue on Ubuntu 24.04, has anyone run into this before?

Use this single sequence (Sign in with ChatGPT; no API key):

# set proxy while keeping localhost un-proxied (needed for OAuth callback)
export no_proxy="127.0.0.1,localhost,::1"
export http_proxy="http://127.0.0.1:8080"     # change ports to your local proxy
export https_proxy="http://127.0.0.1:8080"    # or: socks5h://127.0.0.1:1080
export NO_PROXY="$no_proxy"; export HTTP_PROXY="$http_proxy"; export HTTPS_PROXY="$https_proxy"

# go to your project and start codex
cd /path/to/your/project && codex

# in codex: choose “Sign in with ChatGPT”; keep proxy ON for external sites,
# ensure callback targets http://127.0.0.1:<port>/... (localhost must remain in no_proxy).
# if the browser doesn’t auto-open, copy the login URL from codex into your browser.

# quick checks (optional):
# curl -I https://chat.openai.com         # expect 200/30x via proxy
# echo $no_proxy | grep 127.0.0.1         # must include 127.0.0.1,localhost,::1
`

Token exchange failed: token endpoint returned status 403 Forbidden

After testing it myself, when logging into Codex from VSCode, a localhost prompt as described above appears. Enabling the global proxy (TUN Mode) resolves the issue. The reason is that VSCode does not use the system proxy, so it cannot connect to openai.com, resulting in the inability to verify the returned token.
亲自测试，当从VSCode登录Codex时，出现localhost提示如上内容，开启全局代理（TUN Mode）即可解决。原因是VSCode不走系统代理，因此无法连接到openai.com，导致无法验证返回的token

> Token exchange failed: token endpoint returned status 403 Forbidden After testing it myself, when logging into Codex from VSCode, a localhost prompt as described above appears. Enabling the global proxy (TUN Mode) resolves the issue. The reason is that VSCode does not use the system proxy, so it cannot connect to openai.com, resulting in the inability to verify the returned token. 亲自测试，当从VSCode登录Codex时，出现localhost提示如上内容，开启全局代理（TUN Mode）即可解决。原因是VSCode不走系统代理，因此无法连接到openai.com，导致无法验证返回的token

I could login codex CLI and be authorized normally but failed in VSCode and returned "Token exchange failed: token endpoint returned status 403 Forbidden". Quite strange. My VPN is always TUN mode.

update: My codex in VSCode was suddenly authorized successfully when I left my PC for a while right after I send the comment above. Just so confusing. But maybe the problem is probably because VPN

nice

I ran into a similar problem. I wanted to log into Codex as an extension in VSCode. However, it turned out that due to the VPN, certain redirects didn’t work correctly (the sites opened, the requests were made, but I got a 403). For certain reasons, I couldn’t disable the VPN.

What helped was launching vscode like this:

env \
NO_PROXY="localhost,127.0.0.1,::1" \
no_proxy="localhost,127.0.0.1,::1" \
code

fwiw, on MacOS the brew installation DID NOT work but the one with npm did work, prob cause npm has newer version.

At 2025-09-29:
npm install -g @openai/codex would install version 0.42.0
brew install codex would install version 0.34.0

I ran into a similar problem. I wanted to log into Codex as an extension in VSCode. However, it turned out that due to the VPN, certain redirects didn’t work correctly (the sites opened, the requests were made, but I got a 403). For certain reasons, I couldn’t disable the VPN. What helped was launching vscode like this: env \ NO_PROXY="localhost,127.0.0.1,::1" \ no_proxy="localhost,127.0.0.1,::1" \ code

太棒了，已经解决

localhost,127.0.0.1,::1

Niubility

If you set proxy —> global model , maybe successful

the

> however, I can't login opanAI in macOS browser. when I login, browser return 'Token exchange failed: token endpoint returned status 403 Forbidden'. Is this related to my VPN? I have resolved the issue. It was indeed caused by the VPN. My terminal wasn't using the VPN and required a manual proxy setup.

I have the same problem as you, could you tell me how you configured the proxy manually?

> The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. > Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: > Firewall or antivirus blocking the loopback traffic, > IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), > Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. > As a result, authentication cannot complete. > Solution: > In PowerShell on Windows, install and log in: > npm install -g @openai/codex codex > Complete the login in the Windows browser. > After login, Windows stores credentials at: > C:\Users.codex\auth.json > Copy this file into WSL: > mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json > Now codex in WSL is authenticated without needing to repeat the browser flow. Thanks for the clear write-up—super helpful. I ran into the same issue, and here’s what worked for me on macOS: ## 1. Install Codex CLI on macOS # If Node isn’t installed yet: brew install node # Install Codex CLI npm install -g @openai/codex ## 2. Trigger the login and finish it in your macOS browser codex ## 3. Verify the credentials file exists ls -la ~/.codex cat ~/.codex/auth.json ## 4. Copy the credentials to your remote Linux machine # Prepare the target directory and permissions on the remote host ssh ubuntu@YOUR_SERVER 'mkdir -p ~/.codex && chmod 700 ~/.codex' # Copy from macOS to the remote host scp ~/.codex/auth.json ubuntu@YOUR_SERVER:~/.codex/auth.json # (Optional) Tighten file permissions on the remote host ssh ubuntu@YOUR_SERVER 'chmod 600 ~/.codex/auth.json' After this, running codex on the remote host should work without repeating the browser OAuth flow.

love you

> 令牌交换失败：令牌端点返回状态 403 禁止 自己测试了一下，从VSCode登录Codex时，会出现如上所述的localhost提示。启用全局代理（TUN 模式）可以解决该问题。原因是VSCode没有使用系统代理，所以无法连接到openai.com，导致无法验证返回的token。 高级测试，当从VSCode登录Codex时，出现localhost提示如上内容，开启全局代理（TUN模式）即可解决。原因是VSCode不走系统代理，因此无法连接到openai.com，导致无法验证返回的token

The TUN proxy method is applicable on Ubuntu, thank you.

If you are using codex from vscode in Windows, the problem can be fixed like this:

Firstly, open the system proxy and TUN mode in your proxy software like Clash. You can finish the sign-in like that.

Then, if you are good at using a proxy all the time, you can keep doing that, which is not preferred for most people. You can do the following:

Make a bat on your desktop:

set HTTP_PROXY=http://127.0.0.1:12345
set HTTPS_PROXY=%HTTP_PROXY%
"C:\Program Files\Microsoft VS Code\Code.exe"

Change the port and the location of your vscode.

Click the bat, your clash can turn off the system proxy and TUN mode. Use "test" to see if the codex is working

Everything is good.

> The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. > Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: > Firewall or antivirus blocking the loopback traffic, > IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), > Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. > As a result, authentication cannot complete. > Solution: > In PowerShell on Windows, install and log in: > npm install -g @openai/codex codex > Complete the login in the Windows browser. > After login, Windows stores credentials at: > C:\Users.codex\auth.json > Copy this file into WSL: > mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json > Now codex in WSL is authenticated without needing to repeat the browser flow. Thanks for the clear write-up—super helpful. I ran into the same issue, and here’s what worked for me on macOS: ## 1. Install Codex CLI on macOS # If Node isn’t installed yet: brew install node # Install Codex CLI npm install -g @openai/codex ## 2. Trigger the login and finish it in your macOS browser codex ## 3. Verify the credentials file exists ls -la ~/.codex cat ~/.codex/auth.json ## 4. Copy the credentials to your remote Linux machine # Prepare the target directory and permissions on the remote host ssh ubuntu@YOUR_SERVER 'mkdir -p ~/.codex && chmod 700 ~/.codex' # Copy from macOS to the remote host scp ~/.codex/auth.json ubuntu@YOUR_SERVER:~/.codex/auth.json # (Optional) Tighten file permissions on the remote host ssh ubuntu@YOUR_SERVER 'chmod 600 ~/.codex/auth.json' After this, running codex on the remote host should work without repeating the browser OAuth flow.

Thanks a lot!!! MacOS26 & login codex on the remote server successfully

codex CLI 会在WSL 内部的http://localhost : 启动一个本地 OAuth 回调服务器。 当您在 Windows 浏览器中打开登录链接时，浏览器会尝试重定向回http://localhost :。 通常情况下，Windows 到 WSL 的 localhost 端口转发是有效的，因此回调应该能够到达 WSL 内部的服务器。但是，在某些情况下，由于以下原因，此操作会失败： 防火墙或杀毒软件阻止了环回流量 IPv6 与 IPv4 解析问题（localhost 与 127.0.0.1） 或者是因为登录完全在 Windows 端执行，而服务器只在 WSL 内部监听。 因此，身份验证无法完成。 解决方案： 在 Windows 系统的 PowerShell 中，安装并登录： npm install -g @openai/codex codex 在Windows浏览器中完成登录。 登录后，Windows 会将凭据存储在： C:\Users\<您的用户名>.codex\auth.json 将此文件复制到 WSL 中： mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json 现在，WSL 中的 Codex 无需重复浏览器流程即可进行身份验证。

Ur genius

Since this bug report was filed, we've a number of bugs that were responsible for this behavior. I suspect that there are still some remaining conditions that can cause this — mostly involving network proxies or VPNs. I'm going to close this issue so we can focus our attention on the remaining issues. If you see a related problem, please open a fresh bug report and provide details and repro steps. In particular, include information about any network proxy, VPN or sandboxing environment that you're using.

> however, I can't login opanAI in macOS browser. when I login, browser return 'Token exchange failed: token endpoint returned status 403 Forbidden'. Is this related to my VPN? I have resolved the issue. It was indeed caused by the VPN. My terminal wasn't using the VPN and required a manual proxy setup.

How did you solve it? I'm also facing the same issues I'm using VPN due to China firewall restriction.

The codex CLI starts a local OAuth callback server on http://localhost: inside WSL.codex CLI 在 WSL 中启动本地 OAuth 回调服务器，地址为 http://localhost:。 When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:.当你在 Windows 浏览器中打开登录链接时，浏览器尝试重定向回 http://localhost:。 Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to:通常情况下，Windows → WSL 本地主机端口转发是有效的，因此回调应该能到达 WSL 内的服务器。但在某些配置下，这会失败，原因如下： Firewall or antivirus blocking the loopback traffic,防火墙或杀毒软件阻止了回环流量， IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1),IPv6 与 IPv4 解析问题（localhost 与 127.0.0.1 之间的差异）。 Or because the login was performed entirely on the Windows side while the server is only listening inside WSL.或者因为登录完全在 Windows 端进行，而服务器仅在 WSL 内部监听。 As a result, authentication cannot complete.因此，认证无法完成。 Solution:  解决方案： In PowerShell on Windows, install and log in:在 Windows 的 PowerShell 上安装并登录： npm install -g @openai/codex codex Complete the login in the Windows browser.在 Windows 浏览器中完成登录。 After login, Windows stores credentials at:登录后，Windows 将凭据存储在： C:\Users<YourName>.codex\auth.json Copy this file into WSL:将这个文件复制到 WSL： mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json Now codex in WSL is authenticated without needing to repeat the browser flow.现在 WSL 中的 codex 无需重复浏览器流程即可完成认证。

I've been trying to switch my Codex workflow from native Windows to running inside WSL, and I spent nearly four hours debugging it in the middle of the night, trying all kinds of methods.
Your solution finally worked — absolutely brilliant. Thank you so much!

te

The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: Firewall or antivirus blocking the loopback traffic, IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. As a result, authentication cannot complete. Solution: In PowerShell on Windows, install and log in: npm install -g @openai/codex codex Complete the login in the Windows browser. After login, Windows stores credentials at: C:\Users<YourName>.codex\auth.json Copy this file into WSL: mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json Now codex in WSL is authenticated without needing to repeat the browser flow.

This is absolutely genius

The codex CLI starts a local OAuth callback server on http://localhost: inside WSL. When you open the login link in a Windows browser, the browser attempts to redirect back to http://localhost:. Normally, Windows → WSL port forwarding for localhost works, so the callback should reach the server inside WSL. However, in some setups this fails due to: Firewall or antivirus blocking the loopback traffic, IPv6 vs IPv4 resolution issues (localhost vs 127.0.0.1), Or because the login was performed entirely on the Windows side while the server is only listening inside WSL. As a result, authentication cannot complete. Solution: In PowerShell on Windows, install and log in: npm install -g @openai/codex codex Complete the login in the Windows browser. After login, Windows stores credentials at: C:\Users<YourName>.codex\auth.json Copy this file into WSL: mkdir -p ~/.codex cp /mnt/c/Users//.codex/auth.json ~/.codex/auth.json Now codex in WSL is authenticated without needing to repeat the browser flow.

great solution!!!!

我在ubuntu里遇到这个问题，把vscode和网页的代理设置好就解决了