Login failed — token exchange failed: error sending request to URL (https://auth.openai.com/oauth/token)

macOS 26.5.1
Apple Silicon
Codex CLI 0.139.0

Same issue.

Web ChatGPT works.
Desktop login fails.
CLI login fails.
Device auth fails.

Token exchange failed:
error sending request for url
https://auth.openai.com/oauth/token

Same issue.

macOS 26.5.1
Apple Silicon
Codex CLI 0.139.0

Desktop login fails
CLI login fails
Device Auth fails

curl auth.openai.com works
curl chatgpt.com/backend-api returns cf-mitigated: challenge

English translation:

What version of the Codex App are you using (From “About Codex” dialog)?

Latest version

What subscription do you have?

plus

What platform is your computer?

windows

What issue are you seeing?

Error code
token_exchange_failed
Details
Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

What steps can reproduce the bug?

Unable to log in to Codex; the web version works normally

What is the expected behavior?

_No response_

Additional information

_No response_

<!-- codex-issue-translator -->

same for here.... any idea?

same for my MacBook.

can any add some info? thanks

After deleting the dir "~/.codex", I could log in successfully finally. But I don't think this is a good way to solve this issue.

I can reproduce the same issue, but only when running the ChatGPT extension inside WSL Remote.

Environment

• Windows 11 Insider (10.0.26200.8655)
• WSL 2.7.8.0
• Ubuntu 24.04.4 LTS
• Kernel 6.18.33.1-1
• VS Code 1.125.1
• ChatGPT extension 26.616.41845
• Bundled Codex CLI 0.142.0-alpha.6
• ChatGPT Plus

Behavior

Windows VS Code authenticates successfully.

The same account fails only when VS Code is connected to WSL Remote.

The browser login completes, but the callback page shows:

Token exchange failed:
error sending request for url (https://auth.openai.com/oauth/token)

Running the bundled CLI directly produces the same result:

codex login

fails with:

error sending request for url (https://auth.openai.com/oauth/token)

and

codex login --device-auth

also fails with:

error sending request for url (https://auth.openai.com/api/accounts/deviceauth/usercode)

Additional troubleshooting

• No proxy configured.
• curl https://auth.openai.com/oauth/token succeeds (HTTP 405 as expected).
• curl -4 also succeeds.
• CA certificates are present.
• System time is correct.
• The bundled codex binary is statically linked.

This suggests the issue is specific to the Linux/WSL bundled Codex CLI rather than general network connectivity.

hi @etraut-openai , can you please add some update about this issue , thanks in advance

Codex Remote Login Troubleshooting

localhost Refused to Connect

After logging in, the browser may show:

localhost refused to connect

Codex is running on the remote server, but the OAuth callback uses localhost:1455. In VS Code Remote SSH, open the PORTS panel and forward remote port 1455 to the local machine. Then restart the Codex login process.

Token Exchange Failed

After port forwarding, Codex may show:

Token exchange failed: error sending request for url

This usually means the remote server cannot connect to the authentication service. Enable TUN mode for the proxy on both the local machine and the remote server, then restart the login process.

The issue is now resolved in my environment.

Previously, login failed with:

• VS Code: 1.125.1
• Bundled Codex CLI: 0.142.0-alpha.6

After updating, login succeeds with:

• VS Code: 1.129.1
• Bundled Codex CLI: 0.144.5

I did not change my WSL, proxy, network, CA certificate, or authentication settings.

Current environment:

• Windows: 10.0.26200.8655
• WSL: 2.7.8.0
• Ubuntu: 24.04.4 LTS
• Kernel: 6.18.33.1-1
• VS Code Remote - WSL

So the issue may have been resolved by a recent VS Code, ChatGPT extension, or bundled Codex CLI update.

@sunny2eastgo i use the codex extension for Vs code, my VScode version is the last (1.129) and the version of the codex is the 26.5715. i already try update and change version several time but still get the same error every time.... and we dont have any answer about this.... i think is serious... please can some one add some info... thanks in advance

Resolved in my case. The root cause was a stale per-user proxy environment variable, not the Codex app itself.

My browser worked normally because it used the Windows system proxy, but Codex inherited old environment variables:

HTTP_PROXY=http://127.0.0.1:6850
HTTPS_PROXY=http://127.0.0.1:6850

Port 6850 was no longer listening. My actual proxy client was listening on 127.0.0.1:7892. Because Codex was trying to use the dead port, it failed with:

token_exchange_failed
Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

Before the login failure, I also saw repeated streaming errors:

stream disconnected before completion: error sending request for url (https://chatgpt.com/backend-api/codex/responses)

What fixed it

1. Find the proxy client's real listening port:

netstat -ano | findstr LISTENING

1. Check proxy-related environment variables:

Get-ChildItem Env: | Where-Object Name -Match 'PROXY'
[Environment]::GetEnvironmentVariable("HTTP_PROXY", "User")
[Environment]::GetEnvironmentVariable("HTTPS_PROXY", "User")

1. Update the stale values to the proxy client's actual port, or remove them if you want Codex to rely on the Windows system proxy. Example only — replace 7892 with your own real port:

setx HTTP_PROXY "http://127.0.0.1:7892"
setx HTTPS_PROXY "http://127.0.0.1:7892"

To remove stale user variables instead:

[Environment]::SetEnvironmentVariable("HTTP_PROXY", $null, "User")
[Environment]::SetEnvironmentVariable("HTTPS_PROXY", $null, "User")
[Environment]::SetEnvironmentVariable("ALL_PROXY", $null, "User")

1. Fully terminate every ChatGPT.exe and codex.exe process, then start the app again. Environment-variable changes only apply to newly started processes.

After correcting the port and restarting all Codex/ChatGPT processes, both OAuth login and streaming worked immediately.

This is worth checking especially when browser login works but the Windows desktop app fails, and reinstalling the app does not help, because user environment variables survive an app reinstall.

I'm seeing the same issue on Arch Linux with codex-cli 0.145.0.

Environment

• OS: Arch Linux (x86_64)
• Codex CLI: 0.145.0
• Install method: npm install -g @openai/codex
• Node.js: v26.4.0
• npm: 12.0.1
• ChatGPT account: Personal (Free plan)
• No proxy
• No VPN
• Running locally (not Docker or WSL)

Reproduction

1. Run:

codex login

1. Browser opens normally.
2. Sign in with ChatGPT.
3. Click Continue.
4. Browser shows:

Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

1. CLI prints:

Error logging in: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

Diagnostics

codex doctor reports:

✗ auth
no Codex credentials were found

✗ reachability
ChatGPT base URL:
https://chatgpt.com/backend-api/
request timed out (required)

Network checks

The OAuth endpoint itself is reachable.

Running:

curl -X POST https://auth.openai.com/oauth/token

returns the expected response:

{
  "error": {
    "message": "Missing required parameter: 'grant_type'.",
    "type": "invalid_request_error",
    "param": "grant_type",
    "code": "missing_required_parameter"
  }
}

Additional checks performed:

• curl -I https://auth.openai.com/oauth/token returns HTTP/2 405 (expected for a GET request).
• curl -4 -I https://chatgpt.com reaches Cloudflare normally.
• IPv6 connectivity was tested and temporarily disabled with no change.
• No proxy or VPN configured.
• Browser authentication succeeds until the final Continue step.

I've ruled out local networking, proxy configuration, and basic connectivity to auth.openai.com.

I'm happy to provide additional diagnostics or test a debug build if that would help.

我的问题已解决。根本原因是用户代理环境变量过期，而不是 Codex 应用本身的问题。 我的浏览器运行正常，因为它使用了Windows系统代理，但Codex继承了旧的环境变量： `` HTTP_PROXY=http://127.0.0.1:6850 HTTPS_PROXY=http://127.0.0.1:6850 ` 端口6850已停止监听。我的代理客户端正在监听另一个127.0.0.1:7892端口。由于 Codex 尝试使用已失效的端口，因此失败并显示以下错误信息： ` token_exchange_failed Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token) ` 在登录失败之前，我还看到反复出现流媒体错误： ` stream disconnected before completion: error sending request for url (https://chatgpt.com/backend-api/codex/responses) ` ### 是什么解决了这个问题 1. 找到代理客户端的实际监听端口： netstat -ano | findstr LISTENING 2. 检查代理相关的环境变量： Get-ChildItem Env: | Where-Object Name -Match 'PROXY' [Environment]::GetEnvironmentVariable("HTTP_PROXY", "User") [Environment]::GetEnvironmentVariable("HTTPS_PROXY", "User") 3. 将过时的值更新为代理客户端的**实际**端口，或者如果您希望 Codex 依赖 Windows 系统代理，则删除这些值。示例仅供参考——请替换7892为您自己的实际端口： setx HTTP_PROXY "http://127.0.0.1:7892" setx HTTPS_PROXY "http://127.0.0.1:7892" 要改为删除过时的用户变量： [Environment]::SetEnvironmentVariable("HTTP_PROXY", $null, "User") [Environment]::SetEnvironmentVariable("HTTPS_PROXY", $null, "User") [Environment]::SetEnvironmentVariable("ALL_PROXY", $null, "User") 4. 完全终止所有ChatGPT.exe进程codex.exe`，然后重新启动应用程序。环境变量的更改仅对新启动的进程生效。 修正端口并重启所有 Codex/ChatGPT 进程后，OAuth 登录和流媒体播放都立即恢复正常。 这一点尤其值得检查，因为当浏览器登录成功但 Windows 桌面应用程序失败，并且重新安装应用程序也无济于事时，用户环境变量会在应用程序重新安装后仍然存在。

I had the same issue, and I resolved it by following your instructions.

My device: Macbook Air, MacOS Sequoia 15.7.4
I had the same issue, solved by following instruction

症状：

token_exchange_failed
Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

或者在登录失败之前反复出现：

stream disconnected before completion: error sending request for url (https://chatgpt.com/backend-api/codex/responses)

根本原因

问题的本质是：系统中残留了指向旧端口的代理环境变量（HTTP_PROXY / HTTPS_PROXY），而你的代理软件早已切换到了新端口。

• 浏览器（Chrome / Safari 等）通常读取的是"系统代理设置"（网络设置里的代理配置），代理软件会实时更新这个设置，所以浏览器永远能找到正确的转发地址。
• Codex / ChatGPT 客户端这类程序，是读取环境变量 HTTP_PROXY / HTTPS_PROXY 来决定要不要走代理、走哪个端口。这个变量一旦被设置过，不会随着代理软件重启或换端口而自动更新，会一直"卡"在旧值上。

解决方案

Say 7897 is the proxy we are using, 7890 is the old proxy.
(Make sure you know the proxy your VPN is using. May check it in the setting of VPN)

停用并保留备份：

launchctl bootout gui/$(id -u)/com.user.codex-proxy-env 2>/dev/null

mkdir -p ~/Desktop/disabled-launch-agents

mv ~/Library/LaunchAgents/com.user.codex-proxy-env.plist \
   ~/Desktop/disabled-launch-agents/

清掉当前终端里的失效代理：

unset http_proxy https_proxy all_proxy

然后：

1. 完全退出 Codex、终端和浏览器。
2. 重新打开它们。
3. 验证：

env | grep -iE '^(http|https|all)_proxy='

确认结果中不再出现 127.0.0.1:7890。

Important

注意大小写代理“用途相似，但彼此不同“。特别注意大小写都要检查
在 macOS/Linux 中，环境变量区分大小写：

http_proxy  ≠  HTTP_PROXY
https_proxy ≠  HTTPS_PROXY
all_proxy   ≠  ALL_PROXY

它们不会自动同步，删除小写也不会影响大写。不同程序读取规则也不同：

• curl 通常优先使用小写变量。
• 对 HTTP，curl 出于安全原因只认 http_proxy，不认 HTTP_PROXY。

i dont use any proxy, so that solutions for me don`t work :(

I am experiencing the same token_exchange_failed error on Windows, but unlike the original report, I do not have a proxy configured.

Environment

• Windows 11 x64, build 26200
• Codex CLI 0.146.0
• Also reproduced after downgrading to 0.145.0
• ChatGPT Plus account
• PowerShell 7
• Codex installed through the official PowerShell installer

Error

Token exchange error: error sending request for url
(https://auth.openai.com/oauth/token)

Error logging in: Token exchange failed: error sending request for url
(https://auth.openai.com/oauth/token)

The browser authentication step completes, but the Codex CLI fails during the OAuth code-to-token exchange.

Important context

Codex authentication was working correctly on the same machine, network and account before I ran codex logout.

After logout, I have been unable to authenticate again.

Before logout, Codex CLI 0.146.0 still recognized my ChatGPT Plus account, although the codex_apps MCP connection was reporting an HTTP transport error.

Troubleshooting already performed

• Confirmed that auth.openai.com resolves correctly.
• Confirmed that TCP port 443 is reachable.
• Confirmed that the OAuth endpoint is reachable through PowerShell/curl.
• Confirmed that there is no WinHTTP proxy configured.
• Confirmed that no HTTP_PROXY, HTTPS_PROXY or ALL_PROXY environment variables are configured.
• Confirmed that the Windows date and time are correct.
• Tested normal browser login.
• Tested codex login --device-auth.
• Reinstalled Codex CLI using the official installer.
• Tested Codex CLI 0.146.0.
• Downgraded and tested Codex CLI 0.145.0.
• The same error occurs in all cases.

Additional observation

Both of these Codex-originated HTTPS operations failed:

1. The codex_apps MCP connection to the ChatGPT backend.
2. The OAuth token exchange with auth.openai.com/oauth/token.

Browser and PowerShell HTTPS access work normally on the same machine.

This suggests that the failure may be specific to the HTTP/TLS client used internally by Codex on Windows, rather than a general network or browser connectivity problem.

Please let me know which Codex logs or diagnostic commands would be useful. I can provide sanitized output without authentication tokens or personal account information.

i just for add some news, now i can logging succesfully, but when i try to start a chat, never get a response..

<img width="426" height="204" alt="Image" src="https://github.com/user-attachments/assets/e4088b80-2f56-4450-a1df-c434fd15d84e" />

It’s very frustrating... I’m using an enterprise account paid for by my company, and after contacting support, they told me the problem is with OpenAI, not them... it’s unbelievable.

SOLVED / WORKAROUND FOUND on Windows 11 with Codex CLI 0.147.0 and Codex Desktop.

I was seeing the same login failures:

• Normal login:

Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

• Device login:

Error logging in with device code: error sending request for url (https://auth.openai.com/api/accounts/deviceauth/usercode)

Web authentication itself worked normally, and curl could reach the OpenAI auth endpoints successfully.

Workaround

What fixed both Codex CLI and Codex Desktop for me was configuring the proxy in Codex’s own dotenv file:

C:\Users\<username>\.codex\.env

with:

HTTP_PROXY=http://127.0.0.1:8888
HTTPS_PROXY=http://127.0.0.1:8888
NO_PROXY=localhost,127.0.0.1,::1

In my setup, 127.0.0.1:8888 is a local HTTP proxy forwarded through an SSH tunnel to a remote HTTP proxy.

After saving the file and restarting Codex:

• codex login --device-auth completed successfully
• Codex Desktop also signed in successfully

Why this works

This is not just an arbitrary dotenv workaround.

In Codex 0.147.0, the startup code explicitly loads environment variables from:

~/.codex/.env

before creating the main runtime.

The source contains a dedicated load_dotenv() path for this file, and normal environment variables such as HTTP_PROXY, HTTPS_PROXY and NO_PROXY are allowed to be loaded from it.

So placing the proxy variables in ~/.codex/.env gives Codex itself access to those values at process startup, instead of relying only on environment variables inherited from the shell.

I also verified this at the network level: the proxy logs showed Codex issuing:

CONNECT auth.openai.com:443

through the configured proxy.

One useful diagnostic detail: during testing, my SSH tunnel temporarily dropped and Codex immediately returned the same generic:

error sending request for url (...)

After restoring the tunnel, authentication succeeded again.

So for anyone seeing this Windows login error while browser login and curl still work:

1. Make sure you have a working HTTP proxy.
2. Put HTTP_PROXY / HTTPS_PROXY / NO_PROXY in ~/.codex/.env.
3. Restart Codex completely.
4. Try authentication again.

This worked for both CLI and Desktop in my environment.

Since Codex already has an explicit startup path for loading ~/.codex/.env, it may be useful to document this proxy configuration method in the official Windows authentication troubleshooting guide.