OpenClaw Codex OAuth Can Look Healthy but Still Never Route: The Missing `auth order` Bug Behind ‘No API key found’

A new OpenClaw bug report describes a failure mode that is easy to misread in production: Codex OAuth login appears successful, but the model still never gets used at runtime.

The visible symptom is usually some variation of:

FailoverError: No API key found for provider "openai-codex"

That message sounds like a missing credential problem. According to the report, that is not the real story.

The OAuth login flow does write a valid Codex profile into auth-profiles.json, but it may leave the provider’s per-agent auth order empty. When that happens, requests can still fall through to your next fallback provider even though openclaw models list says Auth is configured.

Sources:

• OpenClaw issue: openclaw/openclaw#63856
• OAuth docs referenced by the report: docs/concepts/oauth.md
• Auth semantics docs referenced by the report: docs/auth-credential-semantics.md

What is actually broken

The reported sequence is:

1. Run openclaw models auth login --provider openai-codex
2. Complete the browser OAuth flow successfully
3. See a new profile written under auth-profiles.json
4. See openclaw models list show Codex as authenticated
5. Send a real model request
6. Watch runtime fail with No API key found for provider "openai-codex"

The key detail is that the login flow appears to save the profile, but does not populate the provider’s routing order for the agent.

That means this is not the same as:

• OAuth browser login failing outright
• the credential file never being written
• the user forgetting to authenticate at all

It is a subtler break: setup looks complete, but routing is still incomplete.

Why operators can get misled

This report is worth paying attention to because it breaks a very common operator assumption:

If models auth login succeeds and models list says Auth: yes, the model is ready to serve traffic.

In the reported case, that assumption is wrong.

The CLI presents a healthy-looking state, but the runtime still cannot select a usable Codex credential because order["openai-codex"] remains empty. The result is a fallback decision that makes it look like Codex has no usable credential at all.

That is especially nasty if you already configured a fallback chain such as:

• openai-codex/gpt-5.4
• deepseek/deepseek-chat
• another paid or filtered provider

Instead of failing loudly at setup time, OpenClaw may silently move traffic to the next provider in line.

The practical impact

According to the issue, this can cause all Codex requests to miss the intended provider even though the user completed the documented OAuth flow.

That has several real-world consequences:

• your ChatGPT subscription path may never be used
• traffic can spill into fallback providers you did not intend to pay for
• the fallback provider’s own errors can hide the real root cause
• debugging gets slower because the UI and CLI both suggest auth is already in place

For teams using Codex as the default primary model, this is not a cosmetic bug. It can change routing behavior for every request.

How to confirm you hit this exact issue

You are likely seeing the same bug if most of the following are true:

1. You used openclaw models auth login --provider openai-codex
2. OAuth completed successfully in the browser
3. openclaw models list shows Codex as authenticated
4. Live requests still fail with No API key found for provider "openai-codex"
5. Runtime falls through to another provider in your fallback chain
6. openclaw models auth order get --agent <agent> --provider openai-codex shows no order override

The last check is the most important one because it separates this report from simpler cases like:

• expired OAuth session
• wrong agent target
• broken fallback config
• unrelated provider-side outage

What the current workaround does

The report says the issue becomes immediately fixable after manually setting auth order, for example:

openclaw models auth order set --agent main --provider openai-codex <profile-id>

After that, the same setup starts routing correctly because both the provider order and the last known good entry become populated.

That is useful for operators because it tells you where the break really is:

• the profile exists
• the runtime can use it
• but it needs the missing order state to become routable

So the workaround is not “re-login again and hope.” It is check and populate the provider order explicitly.

What to do right now

If Codex is business-critical in your environment, the safest short-term response is operational, not theoretical.

1) Check auth order after OAuth login

Do not stop at openclaw models list.

Also run:

openclaw models auth order get --agent main --provider openai-codex

If it comes back empty, treat the setup as incomplete even if the UI looks fine.

2) Test a real request before declaring OAuth healthy

After login, send one real model call through the actual agent you plan to use.

This bug lives in the gap between “credential saved” and “runtime can route it,” so a real request is the only reliable verification.

3) Be careful with fallback chains during diagnosis

If your next fallback provider returns a different error, it can waste time and hide the real problem.

When diagnosing Codex OAuth, check whether the runtime is actually hitting Codex before trusting the downstream error.

4) Document the manual fix in your runbook

Until upstream behavior changes, teams using Codex OAuth should consider adding an extra verification step to their internal onboarding:

• complete OAuth login
• verify order override exists
• send one live request

That is not elegant, but it is safer than assuming login alone made the agent routable.

Split No API key found into three routing checks

This search entry can easily trap operators in a loop of logging into OAuth again and again. A better on-call split is to check three links in the routing chain:

1. Credential link: does the OAuth profile exist, and is the token still valid? If not, this is a login or refresh problem.
2. Order link: did per-agent order include Codex, and does it sit before the fallback provider you expect? If this is empty, a successful login still will not be selected at runtime.
3. Runtime link: did the real request enter the Codex adapter, or did it already fall through to the next provider? This decides whether to debug Codex OAuth or the fallback provider's key.

These checks prevent every No API key found report from being misclassified as a missing secret. For search readers, the next move is not another login attempt. It is proving that credentials, routing order, and the provider actually hit by runtime all agree.

Why this is different from earlier Codex OAuth articles

OpenClaw users may remember earlier troubleshooting around legacy models.providers.openai-codex overrides shadowing newer built-in OAuth behavior.

That is a different failure class.

This new report says the built-in login flow itself may leave routing state unfinished. In other words:

• earlier articles focused on old manual config overriding new behavior
• this issue focuses on new login flow not fully wiring the credential for the agent

If you removed legacy overrides already and still see No API key found, this newer issue is the next place to look.

Pre-flight checklist before you change auth order

Before you edit provider settings or re-run OAuth, capture the routing evidence that proves this is the order-runtime bug:

1. OAuth state: confirm the Codex profile exists and shows as authenticated before you change anything.
2. Per-agent order state: record whether the affected agent has an empty order, the wrong provider first, or Codex missing entirely.
3. Runtime trace: run one small task and note which provider adapter actually receives the request.
4. Fallback symptom: save the exact No API key found provider name so you can tell Codex routing failure from a real fallback-provider secret issue.
5. Persistence check: refresh or restart the relevant OpenClaw process and confirm the order survives before calling the workaround stable.

This keeps high-intent OAuth traffic from wasting time on repeated login attempts when the real failure is the handoff between authenticated profile and agent runtime selection.

After manually setting order, run four recovery checks

When you populate the Codex profile with openclaw models auth order set, do not close the incident just because the command succeeds. Run these checks before restoring normal traffic:

1. Retest the same agent: send one real request through the affected agent and confirm it actually enters openai-codex, not the next fallback provider.
2. Retest a new agent: if your team creates agents often, create a minimal new agent and confirm the default setup path does not keep missing order state.
3. Re-check after restart: restart the Gateway or relevant OpenClaw process, then run auth order get again to prove the manual fix persisted.
4. Record routing and cost context: leave the before/after provider, profile id, and fallback chain in the handoff so later traffic shifts are not misread as model-quality changes.

This turns “Codex replies again” into handoff-grade recovery evidence for operators searching Codex OAuth auth yes but runtime fallback.

If direct or homepage traffic opens this OAuth page

Latest GA4 puts this Codex OAuth issue beside the Chinese homepage, setup-adjacent pages, and the general agent troubleshooting guide. Treat that as high-intent operator traffic: the reader probably has a working OpenClaw install, but one agent is still falling through to the wrong runtime.

Use this quick routing before changing secrets:

1. Came from setup: verify the base install and callback path first, because a broken local callback can look like an auth-order bug.
2. Came from the troubleshooting guide: capture runtime, provider order, and fallback provider before editing anything, so the incident remains reproducible.
3. Came from a shared direct link: write down the affected agent id, profile id, and first failing transcript line before applying the workaround.

That turns this article from a one-off bug note into an operational entry page for OAuth, runtime selection, and fallback-provider evidence.

If you came from Codex OAuth search, separate login, runtime order, and fallback symptoms

This incident attracts three nearby search intents that need different fixes. Use this split before rotating credentials or changing every agent config at once:

• OAuth login failed before an agent starts: validate the browser/session login path and token storage first. Runtime order is not the first suspect yet.
• OAuth login succeeded, but a specific agent still uses the wrong provider: inspect the per-agent provider order and any legacy openai-codex override that can outrank the intended runtime.
• The task falls back only after one model or provider errors: capture the first provider error and fallback decision in the same transcript, then fix the failing provider instead of masking it with another default.

For operators, the fastest evidence packet is one successful login check, one printed runtime order for the failing agent, and one transcript line showing which provider was actually selected. That keeps Codex OAuth traffic on the shortest troubleshooting path.

Search-entry triage: why Codex can still fall back after OAuth login

If you landed here from searches like “Codex OAuth fallback”, “OpenAI Codex per-agent order”, or “OpenClaw Codex still uses default model after login”, split the diagnosis into four layers:

1. Check whether OAuth only completed account login: a successful login does not prove the per-agent runtime order was written or read.
2. Check the configuration location: make sure the expected per-agent order is written to the config file the current runtime actually reads, not an old workspace or default profile.
3. Check the agent selection path: if runtime selection happened before login or from a cache, later OAuth success may not change an already-started agent.
4. Check whether fallback is intentional safety behavior: some fallbacks come from missing auth, while others come from model aliases, provider mapping, or incomplete environment variables.

The key is to split “login succeeded” into four states: credentials available, config written, runtime read the config, and the agent reselected the intended provider. Do not debug only the OAuth page.

Separate OAuth success from runtime readiness

Operators who arrive from “OpenAI Codex OAuth login succeeds but runtime falls back” usually need one distinction first: OAuth success only proves the browser account flow completed. It does not prove the per-agent runtime can actually use that provider order. Before changing credentials or deleting sessions, split the incident this way:

1. Account login state: confirm the OAuth callback completed and the expected account is visible to the Codex runtime.
2. Provider order state: check whether the agent-specific provider order still points at Codex first, or whether a default model/runtime override replaced it.
3. Runtime launch state: start a tiny diagnostic run and record the selected runtime, selected model, and first provider error before retrying a production task.
4. Fallback boundary: if OAuth is healthy but the runtime chooses a different provider, treat it as configuration or provider-order drift, not an authentication outage.

This keeps high-intent visitors from repeatedly logging in when the real fix is to align provider order, runtime selection, and per-agent model configuration.

Turn Codex OAuth traffic into an auth-boundary check

If you arrived from searches such as “Codex OAuth login,” “per-agent order runtime,” or “login succeeds but runtime falls back,” do not start by blaming model availability. Split the investigation into three checks first: whether the OAuth token was actually written, whether per-agent order reads the new credential, and whether runtime fallback is caused by auth failure or config precedence.

The minimal evidence packet is the login completion time, the current agent order config, the runtime that actually started, and gateway logs around the fallback. Only escalate it as an OpenAI Codex OAuth mapping or runtime-selection bug when the token exists but per-agent order still does not take effect. Otherwise, fix local auth state or the configuration layer first.

Related reading

• Troubleshooting OpenClaw Agents: What to Check When Tasks Stall or Tools Misbehave
• OpenClaw Update Guide (2026-02-02): What to Check Before and After You Upgrade
• OpenClaw Complete Installation Guide: Self-hosting Setup, Checkpoints, and Common Pitfalls
• What to Check First When sessions_send Times Out

Bottom line

If OpenClaw Codex OAuth looks configured but every real request still falls back with No API key found, do not assume the credential is missing.

The current report points to a narrower but more dangerous gap: the profile may exist, while per-agent auth order is still empty, leaving Codex unroutable at runtime.

For now, the safest operator move is simple: verify the order state explicitly, then test one real request before you call Codex OAuth setup done.

If troubleshooting traffic lands here, separate OAuth state from agent runtime selection

GA4 now shows this article next to setup and other agent troubleshooting entries. Readers may arrive after a Codex login appears successful in the browser, while the next agent still falls back to the wrong runtime or provider order.

Before repeating the login flow, split the failure into three checks:

1. OAuth never completed for the active user: confirm the callback reached the local OpenClaw process and that the credential store changed after the browser step.
2. OAuth completed but the agent order ignored Codex: inspect the per-agent runtime/provider ordering, because a valid token can still be bypassed by fallback priority.
3. Codex starts but another runtime answers: capture the session id, selected runtime, model alias, and first transcript line so the issue stays a routing bug, not an auth bug.

This keeps setup-minded readers from burning time on repeated OAuth attempts when the real fix is runtime selection or provider ordering.

Three-minute triage after arriving from search: OAuth, order, or fallback

If you arrived here from the troubleshooting checklist or search, spend three minutes identifying the broken layer before changing anything:

1. Browser OAuth never completed: do not edit order yet. Check callback reachability, local port, and whether the credential store actually changed.
2. OAuth completed but order is empty or wrong: stay on this page, fix per-agent auth order first, and record the before/after difference.
3. Order is correct but another provider reports a key error: confirm whether the real runtime ever entered Codex. If it already fell through, the failure may now belong to the next provider.
4. It works once after the edit: do not close the incident yet. Recheck order and run one real request after restart so you are not validating a cache or temporary state.

This separates auth yes, No API key found, and fallback-provider errors so high-intent readers stop repeating OAuth login when the real break is agent runtime selection.

After recovery, add these five regression cases to the Codex OAuth SOP

If the incident recovered only after manually setting order or repeating OAuth, do not close the ticket with “fixed.” Add these five regression cases to the team SOP so the next upgrade or new agent can be checked quickly:

1. New-user OAuth: a user who has never logged into Codex completes authorization, then a new agent receives the correct provider order automatically.
2. Existing-user token refresh: an existing profile refreshes or re-authorizes, and the original agent order still points to Codex.
3. New-agent default routing: a minimal new agent runs one real request and does not fall through to the fallback provider.
4. Restart persistence: after restarting Gateway or the relevant OpenClaw process, order and real request target remain stable.
5. Fallback protection: when the Codex profile is intentionally disabled, the error points at Codex auth/order instead of misreporting another provider as missing a key.

These regression cases turn a one-time workaround into a durable check for future releases, team onboarding, and self-hosted upgrades.

Before escalating to maintainers, paste this runtime evidence pack

If the agent still falls back after setting order, restarting, and retesting a real request, do not report only that “Codex OAuth still fails.” Maintainers need evidence that points at runtime selection:

1. Environment version: OpenClaw version, run mode (local, Docker, systemd, VPS), and the affected agent name.
2. Auth state: the Codex profile authenticated state from models list or equivalent output, plus whether the profile id changed.
3. Order diff: paste the per-agent auth order before and after the workaround, not only the final success state.
4. Real request target: save one minimal request with session id, model alias, provider adapter, and the first error line.
5. Post-restart result: state whether the order survived a Gateway or OpenClaw restart, disappeared, or was overwritten by older config.

This turns the report from “login feels broken” into a debuggable break between authenticated profile and agent runtime selection, which reduces back-and-forth for maintainers.