›_ Codex Issues
Codex Issues / #31412

401 Missing api.responses.write when ChatGPT auth is routed to a custom Responses API provider / ChatGPT 登录态被路由到自定义 Responses provider 时出现 401

Open 💬 10 comments Opened Jul 7, 2026 by Qiyuanqiii
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

This issue is intentionally bilingual so users searching in either English or Chinese can find it.

本 issue 特意写成中英文对照，方便英文和中文用户都能搜索到。

---

English

I want to share a concrete local cause of the 401 Unauthorized / Missing scopes: api.responses.write error, because it can look like an account/subscription/token problem but may actually be caused by a provider configuration mismatch.

Environment

  • Codex Desktop on Windows
  • Auth mode: ChatGPT sign-in OAuth credentials, not an OpenAI API key
  • Model: gpt-5.5

Symptom

Codex repeatedly failed with:

unexpected status 401 Unauthorized: You have insufficient permissions for this operation.
Missing scopes: api.responses.write.
url: https://api.openai.com/v1/responses

Root cause in my case

While debugging repeated reconnects, I added a custom provider to ~/.codex/config.toml to try to avoid websocket transport:

model_provider = "openai-http"

[model_providers.openai-http]
name = "OpenAI HTTP"
base_url = "https://api.openai.com/v1"
wire_api = "responses"
requires_openai_auth = true
supports_websockets = false
request_max_retries = 4
stream_max_retries = 5
stream_idle_timeout_ms = 300000

After that, every request failed with the api.responses.write 401.

The important part is that this config routed Codex to the public OpenAI Responses API endpoint:

https://api.openai.com/v1/responses

But the active Codex auth was still ChatGPT OAuth sign-in. That token did not include the api.responses.write scope, so the public Responses API rejected the request.

To be clear: I am not claiming Codex automatically added this provider in my case. It was added during troubleshooting. The issue is that this misconfiguration is easy to create, and the resulting error message looks like a generic account/permission failure rather than a local config mismatch.

Fix

Remove this line:

model_provider = "openai-http"

And remove the entire custom provider block:

[model_providers.openai-http]
...

After reverting those config changes, Codex stopped hitting the api.responses.write 401 path.

Suggestion

It would be helpful if Codex could detect this configuration mismatch, for example in codex doctor or startup validation:

  • Auth mode: ChatGPT sign-in
  • Selected provider base URL: https://api.openai.com/v1
  • wire_api = "responses"
  • requires_openai_auth = true

In that case, Codex could warn that ChatGPT OAuth credentials may not have the api.responses.write scope required by the public Responses API, and suggest either removing the custom provider or using the correct API-key based auth/provider setup.

This would save users from diagnosing it as a subscription/token issue when the actual cause is local provider routing.

---

中文

我想分享一个会导致 401 Unauthorized / Missing scopes: api.responses.write 的本地配置原因。这个问题表面上很像账号权限、订阅、token 失效或凭证问题，但实际也可能是 config.toml 里的 provider 配置不匹配导致的。

环境

  • Windows 上的 Codex Desktop
  • 认证方式：ChatGPT 登录态 / ChatGPT OAuth 凭证
  • 不是 OpenAI API Key
  • 模型：gpt-5.5

现象

Codex 反复失败，报错类似：

unexpected status 401 Unauthorized: You have insufficient permissions for this operation.
Missing scopes: api.responses.write.
url: https://api.openai.com/v1/responses

中文关键词：401 未授权、缺少 scope、api.responses.write、https://api.openai.com/v1/responses、ChatGPT 登录态、config.toml。

我这里的根因

我在排查“正在重新连接 / reconnecting”问题时，为了尝试避开 websocket transport，手动在 ~/.codex/config.toml 里加了一个自定义 provider：

model_provider = "openai-http"

[model_providers.openai-http]
name = "OpenAI HTTP"
base_url = "https://api.openai.com/v1"
wire_api = "responses"
requires_openai_auth = true
supports_websockets = false
request_max_retries = 4
stream_max_retries = 5
stream_idle_timeout_ms = 300000

加完之后，所有请求都开始报 api.responses.write 相关的 401。

关键点是：这个配置把 Codex 请求路由到了公开 OpenAI Responses API：

https://api.openai.com/v1/responses

但是当前 Codex 使用的仍然是 ChatGPT 登录态 / OAuth 凭证，而不是 OpenAI API Key。这个 ChatGPT OAuth token 没有 api.responses.write scope，所以公开 Responses API 返回 401。

需要说明：我不是说 Codex 在我的案例中自动添加了这个 provider。这个 provider 是排查问题时手动加进去的。问题在于，这种误配置很容易出现，而最终的错误信息看起来像普通的账号权限问题，不容易让用户想到是本地 provider 配置不匹配。

修复方式

删除这一行：

model_provider = "openai-http"

并删除整个自定义 provider 段：

[model_providers.openai-http]
...

回滚这些配置后，Codex 就不再走 api.responses.write 这条 401 路径了。

建议

希望 Codex 可以在 codex doctor 或启动校验里检测这种配置不匹配，例如：

  • 认证方式是 ChatGPT sign-in / ChatGPT 登录态
  • 当前 provider 的 base_url 是 https://api.openai.com/v1
  • wire_api = "responses"
  • requires_openai_auth = true

这种情况下，Codex 可以提示：ChatGPT OAuth 凭证可能没有公开 Responses API 所需的 api.responses.write scope，并建议用户删除这个自定义 provider，或者改用正确的 API-key/provider 配置。

这样可以避免用户把问题误判成订阅、账号权限或 token 失效；实际原因可能只是本地 provider 路由配置不匹配。

View original on GitHub ↗

10 Comments

github-actions[bot] contributor · 13 days ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #30351

Powered by Codex Action

Qiyuanqiii · 13 days ago

Thanks for the duplicate check. This is related to #30351, but I am keeping this issue open because it documents a narrower reproducible local configuration path: ChatGPT sign-in auth being routed to a custom provider using base_url = "https://api.openai.com/v1" + wire_api = "responses", which then fails with Missing scopes: api.responses.write.

中文补充：这个 issue 确实和 #30351 相关，但这里记录的是一个更具体、可复现的本地配置场景：ChatGPT 登录态被路由到自定义 https://api.openai.com/v1 + wire_api = "responses" provider，导致缺少 api.responses.write scope 的 401。

Mahkhmood9 · 13 days ago

you need to relogin - it happen to me too -- Auth tokens are intentionally have a lifespan of about 30 days or something --- but I am not sure whats this 401 about ---

Qiyuanqiii · 11 days ago
你需要重新登录——我也遇到过——认证代币的有效期是故意设定大约30天左右---但我不太明白这个401是什么---

emm，401 is Codex's error code indicating authentication failure.

Qiyuanqiii · 11 days ago
你需要重新登录——我也遇到过——认证代币的有效期是故意设定大约30天左右---但我不太明白这个401是什么---

unexpected status 401 Unauthorized: You have insufficient permissions for this operation. Missing scopes: api.responses.write. Check that you have the correct role in your organization (Reader, Writer, Owner) and project (Member, Owner), and if you're using a restricted API key, that it has the necessary scopes., url: https://api.openai.com/v1/responses, cf-ray: a17700dc38425fb7-SIN, request id: e38695c5-fa81-4642-8245-fc73113c2ce9

Mahkhmood9 · 10 days ago
> 你需要重新登录——我也遇到过——认证代币的有效期是故意设定大约30天左右---但我不太明白这个401是什么--- unexpected status 401 Unauthorized: You have insufficient permissions for this operation. Missing scopes: api.responses.write. Check that you have the correct role in your organization (Reader, Writer, Owner) and project (Member, Owner), and if you're using a restricted API key, that it has the necessary scopes., url: https://api.openai.com/v1/responses, cf-ray: a17700dc38425fb7-SIN, request id: e38695c5-fa81-4642-8245-fc73113c2ce9

when gpt 5.5 was launching it was a bit laggy in terms of using the product because so much usage --- i recomend to use codex login again you may have some cloudflare issues maybe? not sure , if you are a chinese users , it usally comes with also being a user . . .

Qiyuanqiii · 10 days ago
> > 你需要重新登录——我也遇到过——认证代币的有效期是故意设定大约30天左右---但我不太明白这个401是什么--- > > > 意外状态 401 未授权：您在此操作中权限不足。缺少作用域：api.responses.write。请检查您在组织中是否拥有正确的角色（阅读、写作者、所有者）和项目（成员、所有者），如果您使用的是受限API密钥，是否具备必要的权限。网址：https://api.openai.com/v1/responses，cf-ray：a17700dc38425fb7-SIN，请求ID：e38695c5-fa81-4642-8245-fc73113c2ce9 GPT 5.5刚发布时，使用起来有点卡顿，因为使用量太大---我建议你再用一次，可能遇到了一些Cloudflare的问题？不太确定，如果你是中国用户，通常也会伴随着......codex login

The Codex login issue itself is easy to resolve. In fact, I already have a stable 20x account. The problem is that every time I use it, after sending the first message, it always gets stuck showing “reconnecting”, and I have to wait for a while before it works properly.

While looking for a way to fix this issue, I found that some people mentioned adding model_providers could help mitigate the problem, so I tried asking Codex to fix it by itself. Unfortunately, Codex does not seem to have actually solved the issue — instead, it appears to have broken its own configuration, which eventually caused the “401” error to appear.

I found that some people on GitHub and various forums had encountered similar “401” issues, so I tried to create a script to solve it — or at least to diagnose the root cause of this damn “401” problem.

Mahkhmood9 · 9 days ago
problem is that every time I use it, after sending the first message, it always gets stuck showing “reconnecting”, and I have to wait for a while before

maybe its a weird cloudflare issue , I know a lot of chinese users have it because they use a vpn -- with a bad trust score

I know it sounds weird but can you try using another VPN (assuming natrually you use a VPN , like most chinese users here)

Mahkhmood9 · 9 days ago
> > 你需要重新登录——我也遇到过——认证代币的有效期是故意设定大约30天左右---但我不太明白这个401是什么--- > > > 意外状态 401 未授权：您在此操作中权限不足。缺少作用域：api.responses.write。请检查您在组织中是否拥有正确的角色（阅读、写作者、所有者）和项目（成员、所有者），如果您使用的是受限API密钥，是否具备必要的权限。网址：https://api.openai.com/v1/responses，cf-ray：a17700dc38425fb7-SIN，请求ID：e38695c5-fa81-4642-8245-fc73113c2ce9

openai itself is very respectful and understand a "good chunk" "a large portion" of users are vpn users themselves (unlike other companies which actually will ratelimit your usage more --- and even if they do it too --- its not to the same level anthropic for example still do today for users )

make sure you have the latest codex version - in the last few days a lot has changed in the api

I recomend trying to maybe see if you observe it with a different vpn service, make sure you use the latest version of codex

actually , I recomend if you used codex login in the past try maybe use codex login --device-auth maybe you get a different type

addionally the --help also says there is 

      --with-access-token
          Read the access token from stdin (e.g. `printenv CODEX_ACCESS_TOKEN | codex login --with-access-token`)

keep in mind only (Codex access tokens are currently supported for ChatGPT Business and Enterprise workspaces.)

i actually recomend in your case
~/.codex (maybe rename to .codex_acrhive)

or delete config.toml and auth.json ,, do not log in using an api-key

 codex login --help
Manage login

Usage: codex login [OPTIONS] [COMMAND]

Commands:
  status  Show login status
  help    Print this message or the help of the given subcommand(s)

Options:
  -c, --config <key=value>
          Override a configuration value that would otherwise be loaded from `~/.codex/config.toml`. Use a dotted path
          (`foo.bar.baz`) to override nested values. The `value` portion is parsed as TOML. If it fails to parse as
          TOML, the raw string is used as a literal.

          Examples: - `-c model="o3"` - `-c 'sandbox_permissions=["disk-full-read-access"]'` - `-c
          shell_environment_policy.inherit=all`

      --with-api-key
          Read the API key from stdin (e.g. `printenv OPENAI_API_KEY | codex login --with-api-key`)

      --enable <FEATURE>
          Enable a feature (repeatable). Equivalent to `-c features.<name>=true`

      --with-access-token
          Read the access token from stdin (e.g. `printenv CODEX_ACCESS_TOKEN | codex login --with-access-token`)

      --disable <FEATURE>
          Disable a feature (repeatable). Equivalent to `-c features.<name>=false`

      --device-auth


  -h, --help
          Print help (see a summary with '-h')
Qiyuanqiii · 8 days ago
> > > 你需要重新登录——我也遇到过——认证代币的有效期是故意设定大约30天左右---但我不太明白这个401是什么--- > > > > > > 意外状态 401 未授权：您在此操作中权限不足。缺少作用域：api.responses.write。请检查您在组织中是否拥有正确的角色（阅读、写作者、所有者）和项目（成员、所有者），如果您使用的是受限API密钥，是否具备必要的权限。网址：https://api.openai.com/v1/responses,cf-ray:a17700dc38425fb7-SIN，请求ID：e38695c5-fa81-4642-8245-fc73113c2ce9 OpenAI本身非常尊重，并且理解“相当一部分”用户本身就是VPN用户（不像其他公司会更严格地限制你的使用频率，即使他们也这么做，---也没有像Anthropic那样对用户的限制---）。 确保你有最新的Codex版本——最近几天API发生了很多变化 我建议你试着用其他VPN服务看看是否能遇到这种情况，确保使用最新版本的Codex 其实，如果你以前用过，我建议你试试，也许换个类型codex logincodex login --device-auth 另外，帮助也说有 `` --with-access-token Read the access token from stdin (e.g. printenv CODEX_ACCESS_TOKEN | codex login --with-access-token) ` 请记住 （Codex access tokens are currently supported for ChatGPT Business and Enterprise workspaces.) 我其实推荐你这种情况 ~/.codex（也许可以改名做 .codex_acrhive） 或者删除config.toml并auth.json，**不要用api密钥登录** ` codex login --help Manage login Usage: codex login [OPTIONS] [COMMAND] Commands: status Show login status help Print this message or the help of the given subcommand(s) Options: -c, --config <key=value> Override a configuration value that would otherwise be loaded from ~/.codex/config.toml. Use a dotted path (foo.bar.baz) to override nested values. The value portion is parsed as TOML. If it fails to parse as TOML, the raw string is used as a literal. Examples: - -c model="o3" - -c 'sandbox_permissions=["disk-full-read-access"]' - -c shell_environment_policy.inherit=all --with-api-key Read the API key from stdin (e.g. printenv OPENAI_API_KEY | codex login --with-api-key) --enable <FEATURE> Enable a feature (repeatable). Equivalent to -c features.<name>=true --with-access-token Read the access token from stdin (e.g. printenv CODEX_ACCESS_TOKEN | codex login --with-access-token) --disable <FEATURE> Disable a feature (repeatable). Equivalent to -c features.<name>=false --device-auth -h, --help Print help (see a summary with '-h') ``

ok