Codex VS Code extension cannot authenticate when running on Remote SSH

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #6413
• #7623
• #6628
• #6849
• #6632

Powered by Codex Action

For additional context: I looked through the suggested duplicate issues, which appear to focus on WSL-specific behavior.

In my case, the Codex extension is running on a Remote SSH rather than WSL. I also tried one of the suggested solutions there, setting chatgpt.runCodexInWindowsSubsystemForLinux = false but this did not change the behavior.

We have recently added support for headless device code authentication. This is still in preview mode, but it's ready for use. See here for instructions. This authentication mechanism is specifically designed to handle cases where you're on a remote server or other environment that cannot receive a redirect from a browser running locally.

Thanks for the update. I tried the new headless device code authentication flow.

However, after I run:
codex login --device-auth

The request fails with:
“Error logging in with device code: device code request failed with status 403 Forbidden”

If the remote ssh is wsl, my solution is logging in host machine (windows I mean), then copy the auth file to ~/.codex/, like cp /mnt/c/Users/your own user name/.codex/auth.json ~/.codex/ This command works for me

If the remote ssh is wsl, my solution is logging in host machine (windows I mean), then copy the auth file to ~/.codex/, like cp /mnt/c/Users/your own user name/.codex/auth.json ~/.codex/ This command works for me

works for me

It's not wsl, that method does not work for me.

I have same problem as you. I'm using VSCode to SSH into my server (Ubuntu 24.04.1) and using the CodeX plugin, but the callback authentication fails at the end of the login process. "http://localhost:1455/auth/callback?code=..." displays "Token exchange failed: token endpoint returned status 403 Forbidden".
I also tried some suggested solutions such as copying the auth.json file from my local Windows to the server. This allowed me to log in, but it gets stuck at the thinking step.
Have you solved this yet?

same

I’m using VS Code. Changing Proxy to Global fixed the issue for me. 盲猜是启动的 local server （1455 端口的服务）和外网通讯的时候出问题了。

I have same problem as you. I'm using VSCode to SSH into my server (Ubuntu 24.04.1) and using the CodeX plugin, but the callback authentication fails at the end of the login process. "http://localhost:1455/auth/callback?code=..." displays "Token exchange failed: token endpoint returned status 403 Forbidden". I also tried some suggested solutions such as copying the auth.json file from my local Windows to the server. This allowed me to log in, but it gets stuck at the thinking step. Have you solved this yet?

Same, I was able to login after copying the auth.json file from my local Windows to the server, but now it gets stuck at the thinking step. Were you able to solve that?

still an issue. they say "close this feature request because the functionality is now in place" ~2798 but localhost port is hardcoded to use the same one as VS Code Remote SSH:

❯ codex login       
Error logging in: Port 127.0.0.1:1455 is already in use
❯ lsof -nP -iTCP:1455 -sTCP:LISTEN
COMMAND    PID   USER   FD   TYPE     DEVICE       SIZE/OFF NODE NAME
Code\x20H 5393   me       42u  IPv4   0xxxxxxxxx        0t0    TCP   127.0.0.1:1455 (LISTEN)

^^ that's on local machine, to copy auth.json to remote manually. if you try to sign in via the Codex extension on the remote, it hangs indefinitely in the browser waiting for localhost redirect (which will never happen since it needs the remote).

I ran into exactly the same issue. From what I can tell, the token exchange request is sent from the remote machine, and the 403 error happens because those remote requests are not properly going through a proxy. This doesn’t appear to be a Codex bug itself.

My solution was to correctly configure a proxy on the remote side and make sure that both the remote VS Code server and the extension’s HTTP requests go through that proxy.

Configure VS Code so remote extensions use the proxy

1. In VS Code settings, set Http: Proxy to your local proxy address.
2. Add localhost, 127.0.0.1, and ::1 to Http: No Proxy.
3. Set Http: Proxy Support to On.
4. Switch to Remote settings and enable Http: Use Local Proxy Configuration.

Set up reverse port forwarding on the remote to reach the local proxy

1. When connecting to the remote host via SSH in VS Code, use a command like:

``bash
ssh -R <remote_proxy_port (same as local proxy port)>:<local_proxy_ip>:<local_proxy_port> user@ip -p port
``

1. The SSH config entry auto-generated by VS Code may be incorrect. For example:

``text
Host ip
HostName ip
RemoteForward 7897:127.0.0.1:7897
User user
Port port
`
You need to change
RemoteForward 7897:127.0.0.1:7897
to
RemoteForward 7897 127.0.0.1:7897`.

1. Reconnect to the remote host. After that, Codex should be able to log in normally.

@UTF-z I met the same problem, and I use your method to partially solve the 403 error, but there is an important issue is that if you already baned 127.0.0.1,localhost, in your vpn settings such as clash, you must do not set "Add localhost, 127.0.0.1, and ::1 to Http: No Proxy." Otherwise, your vscode IDE will be broken.

I also use docker in the remote server, the codex also ran smoothly in docker env.

Spend me a while to get it work, almost give up. here is the solution:
1 In your remote ssh vscode window, click login in button of the codex extention, it will open local browser and jump to a login page.
2 Copy the link from local browser, open vscode integrated browser in your remote vscode window ( https://code.visualstudio.com/docs/debugtest/integrated-browser )
3 Paste the login link to the integrated browser in your remote vscode
4 Input username , password, login, click next.. next...
5 Done!