codex login → "Token exchange error" on macOS (OAuth token exchange fails)

What version of Codex is running?

codex-cli 0.58.0

What subscription do you have?

chatgpt plus

Which model were you using?

GPT-5

What platform is your computer?

macOS 26.1 (Sequoia) — arm64

What issue are you seeing?

When running codex login on macOS (arm64, codex-cli 0.58.0), the OAuth flow starts correctly (local server on http://localhost:1455 and browser opens on auth.openai.com), but the CLI fails at the token exchange step.

After approving the login in the browser, the CLI prints:

Token exchange error: error sending request for url (https://auth.openai.com/oauth/token)

No credentials file is created (~/.codex/credentials.json) and no logs are generated (~/.codex/logs does not exist). The issue is reproduced 100% of the time, even after reboot and after deleting ~/.codex.

TLS connectivity to https://auth.openai.com/oauth/token works:
curl -v https://auth.openai.com/oauth/token → TLS handshake OK

No proxy, no VPN, macOS firewall disabled for testing.

Other OpenAI services work normally on the same machine. The issue seems specific to the CLI failing to complete the OAuth token exchange.

What steps can reproduce the bug?

1. Run codex login
2. Browser opens on auth.openai.com and login/consent succeeds
3. CLI waits for the callback on http://localhost:1455
4. After confirming login in the browser, the CLI prints:

Token exchange error: error sending request for url (https://auth.openai.com/oauth/token)

1. No credentials file is created in ~/.codex/

What is the expected behavior?

The OAuth flow should complete successfully after browser login, the token exchange should succeed, and the CLI should create valid credentials in:

auth.json

The command codex login should finish without errors.

Additional information

• macOS 26.1 (Sequoia), arm64
• codex-cli 0.58.0
• Installed via Homebrew
• No proxy, no VPN
• macOS firewall temporarily disabled for testing
• Folder ~/.codex/logs is not created, so no logs available
• TLS connectivity to https://auth.openai.com/oauth/token works
• Issue is reproducible 100% of the time even after reboot and removing ~/.codex