Fix: Codex OAuth still failing after upgrading? Remove legacy openai-codex provider overrides

TL;DR

If you previously manually configured models.providers.openai-codex in openclaw.json, that legacy block can shadow the newer built-in Codex OAuth provider behavior. The result: you upgrade, re-auth, and still see 401 / scope-like failures.

The workaround reported by users is straightforward:

1. Back up your config
2. Remove the legacy models.providers.openai-codex override
3. Restart OpenClaw

After that, openai-codex/gpt-5.4 may start working immediately.

What changed (and why you might still be broken)

Recent upstream fixes improved Codex OAuth behavior and fallback handling:

• PR #37558: remove a bogus Codex OAuth probe
  • https://github.com/openclaw/openclaw/pull/37558
• PR #38026: enable Chat Completions fallback on scope error (incl. gpt-5.4 cases)
  • https://github.com/openclaw/openclaw/pull/38026

But if your config still contains a hand-written provider definition under models.providers.openai-codex, OpenClaw can keep using your old shape instead of the repaired built-in provider.

Symptoms checklist

You’re a good candidate for this fix if:

• You set up Codex “early” and added explicit models.providers.openai-codex config
• You upgraded to a version that includes the fixes above
• Codex OAuth looks configured, but requests still fail (401 / scope / weird fallback)

The fix (step-by-step)

Before editing: make a backup copy.

1. Open your openclaw.json
2. Find a block like:

{
  "models": {
    "providers": {
      "openai-codex": {
        // ... legacy manual config ...
      }
    }
  }
}

3. Remove (or comment out, if your tooling supports it) only the models.providers.openai-codex override
4. Restart OpenClaw
5. Retry your target model, e.g. openai-codex/gpt-5.4

Who should check this first

Prioritize this check if any of the following sounds like your setup:

• You upgraded after recent Codex OAuth fixes
• You previously added a manual models.providers.openai-codex block
• You still see 401, scope, or fallback errors even after re-authenticating

In practice, this bug often happens when the new built-in behavior is available, but an older manual override still takes precedence. If repeated re-authorization did not help, this is one of the first configuration checks worth making.

Common rollout questions

When should you suspect a legacy provider override instead of redoing OAuth again?

If re-authentication succeeds but the same 401, scope, or fallback pattern returns immediately, stop treating it as a pure OAuth problem. At that point, an older manual provider block is a more likely cause than a fresh auth failure.

What is the lowest-risk way to test this fix in production-like environments?

Back up the config, remove only the models.providers.openai-codex block, restart OpenClaw, and retry one known failing Codex model. This keeps the blast radius small and gives you a clean before-and-after comparison.

Why can this look like an OAuth outage even when your token is fine?

Because the visible symptom happens at request time, teams often assume the access token, scopes, or upstream OpenAI status is still wrong. But if the older models.providers.openai-codex block is winning precedence, OpenClaw may never exercise the newer built-in Codex OAuth path at all. In that case, repeating browser auth flows does not change the code path that is actually serving your requests.

Which environments should check for config shadowing first?

Shared servers, long-lived developer machines, and hosts upgraded across multiple OpenClaw releases should check this first. Those are the environments most likely to carry forward hand-written provider overrides that made sense during early setup but now silently shadow repaired defaults.

Search-intent comparison: legacy provider override vs real Codex OAuth outage

Teams often waste time here because both failures can start with the same visible symptom: Codex requests fail right after login or upgrade. The faster way to separate them is to ask what changed most recently.

Prioritize the legacy override explanation if:

• OAuth re-auth completes, but the exact same request path still fails immediately
• the machine was upgraded across multiple OpenClaw releases
• someone previously hand-edited models.providers.openai-codex

Prioritize a real OAuth outage explanation if:

• new machines with no hand-written provider block fail in the same way
• the browser auth flow itself cannot complete
• multiple operators hit the same breakage at the same time after no config drift

This distinction matters for search intent too. People searching for codex oauth still 401 after upgrade usually do not need another auth walkthrough first. They need a config-precedence check.

What should you leave in the handoff note after fixing it

If you clear this incident, leave a short note for the next operator with four pieces of evidence:

1. the exact host or profile where models.providers.openai-codex was removed
2. the OpenClaw version running before and after the restart
3. one failing model name that recovered, such as openai-codex/gpt-5.4
4. whether any other custom provider overrides are still present

That handoff note prevents the same team from reintroducing the old override during the next migration or debugging session.

What should operators check first before opening a new OAuth incident?

Check whether the host still carries a hand-written models.providers.openai-codex block from an older setup. If that override is still present, treat config precedence as the first likely cause, because repeating OAuth login steps will not change which provider definition OpenClaw is actually using.

Run three regression checks after removing the legacy provider

Do not stop at “one request succeeded.” After removing models.providers.openai-codex, leave three repeatable checks:

1. Retest the same model: use the exact model name that failed before, such as openai-codex/gpt-5.4, so you do not accidentally validate a different path.
2. Retest after restart: restart OpenClaw and run the same request again, proving that config management, sync scripts, or startup hooks did not write the legacy provider back.
3. Compare another provider: spot-check one non-Codex provider to confirm the edit only affected the Codex OAuth path and did not remove shared credentials or global provider settings.

These checks turn “I deleted a config block” into handoff-grade recovery evidence, and help the team decide whether to close the incident or keep investigating the auth chain.

If troubleshooting traffic lands here, separate OAuth failure from legacy provider override

GA4 now shows this Codex OAuth fix page beside setup and runtime-selection traffic, so readers may arrive after a successful browser login but still see Codex fall back or fail inside OpenClaw.

Before repeating OAuth login, split the evidence into three checks:

1. OAuth never completed: confirm the OpenAI authorization callback, local credential cache, and the Codex runtime's own auth status before editing provider config.
2. OAuth completed but a legacy openai-codex override still wins: inspect provider ordering, stale environment overrides, and model routing so the old provider entry is not masking the newer Codex runtime.
3. Codex starts but another runtime answers: compare agent order, runtime selection logs, and provider fallback messages before blaming token scope.

This keeps high-intent setup readers from looping through login screens when the real fix is removing stale provider overrides and confirming runtime precedence.

Three-minute decision: remove the legacy override or leave config alone

If you arrived here from Codex OAuth, setup, or the troubleshooting checklist, do not delete config immediately. Spend three minutes scoping the change:

1. The host previously had a hand-written models.providers.openai-codex block: back up the config, then remove only that block for a minimal validation.
2. There is no hand-written provider and the OAuth flow itself fails: leave config alone and check callback reachability, credential cache, and network access first.
3. The fix only works in the current process: inspect startup scripts, sync tooling, or environment variables that may be writing the legacy override back.
4. Other custom providers exist on the same machine: touch only the Codex-related block so shared credentials or global provider settings are not removed by accident.

This splits “Codex still fails after upgrade” search traffic into two lanes: config precedence shadowing stays on this page; real OAuth or network failure should go back to the authentication chain.

Before deleting the legacy override, prepare this rollback card

On shared hosts or production-like environments, do not treat models.providers.openai-codex as a block to delete blindly. Prepare a small rollback card first:

1. Back up the original block: save only the Codex provider block and nearby model-routing settings, not the full config with secrets.
2. Record the triggering symptom: note whether the pre-fix failure was 401, scope-related, No API key found, or fallback to another provider.
3. Pin the validation model: name one model that failed before, such as openai-codex/gpt-5.4, so success is not accidentally measured on a different path.
4. Define rollback conditions: if non-Codex providers break, startup fails, or config management writes the block back, roll back and inspect startup scripts.
5. Check for a sync source: inspect dotfiles, systemd environment, container env, and config-sync scripts so the legacy override does not revive after restart.

This rollback card moves high-intent visitors from blind config deletion to minimal-radius validation. It also helps teams decide whether traffic recovered because the Codex OAuth path was fixed, or because another configuration drift was only temporarily bypassed.

If the override keeps coming back, inspect the source that writes config

Some teams remove the stale models.providers.openai-codex block, restart, and then see the same Codex OAuth failure return on the next boot. That usually means the broken override is not only in the live config; it is being regenerated by another source.

Before opening a fresh OAuth incident, check these persistence points:

1. Dotfiles or bootstrap scripts: search setup scripts for openai-codex so a personal bootstrap does not reapply the old provider.
2. Container or systemd environment: compare runtime env with the edited config file, especially if the service starts from a template.
3. Config sync tooling: inspect any repo, secret manager, or host profile that rewrites OpenClaw config after deploy.
4. Multiple profiles on one host: confirm the profile used by the failing agent is the same profile you edited.

This is the right next branch when the page solved the first run but not the restart. It keeps recurring Codex OAuth traffic focused on config ownership instead of repeating browser login.

Turn legacy override traffic into a migration checklist

If you arrived because a legacy openai-codex override blocks Codex OAuth, model order, or runtime selection, do not fix it by deleting one line first. A safer migration path is to list the current agent order, global runtime override, environment variables, and local OAuth state, then identify which layer is still winning precedence.

The minimal checklist is the source file for the old override, the selected provider/model, the token update time after login, and the runtime that starts after a clean restart. Escalate it as a compatibility fix only when the old config still overrides the new OAuth path after restart. Otherwise, finish config cleanup and credential refresh first.

Related reading

• Troubleshooting OpenClaw Agents
• OpenClaw Complete Installation Guide
• OpenClaw Quick Install Guide for macOS

Sources

• GitHub issue (detailed repro + workaround):
  • https://github.com/openclaw/openclaw/issues/40066
• Related upstream fixes:
  • https://github.com/openclaw/openclaw/pull/37558
  • https://github.com/openclaw/openclaw/pull/38026

Search-entry triage: what to check when Codex OAuth still uses a legacy override

If you landed here from searches like “Codex OAuth still uses legacy OpenAI override”, “OpenClaw Codex OAuth fallback”, or “Codex login still uses old OpenAI config”, split the issue into four layers:

1. Check where the active agent order comes from: do not rely only on the OAuth success screen. Confirm whether runtime actually selected the Codex agent, the OpenAI agent, or an older override order.
2. Check whether the legacy override is still being read: environment variables, old config files, per-agent order, and default provider order can coexist; the runtime resolution result is what matters.
3. Check OAuth credential binding: successful OAuth does not mean every agent automatically switches. Confirm token location, agent id, and runtime read scope match.
4. Preserve the smallest useful evidence: login method, agent-order snippet, provider selection in startup logs, and the model actually receiving requests are more useful than saying “it still falls back”.

Do not debug this class of issue only by repeating OAuth login. The shortest path is to compare credentials, agent order, legacy override, and runtime provider-selection logs.

Related reading

• Why Codex can still fall back after OAuth login: check per-agent order first
• Troubleshooting OpenClaw Agents: What to Check When Tasks Stall or Tools Misbehave
• OpenClaw Complete Installation Guide: From Zero to Working Setup
• What to Check First When sessions_send Times Out

Safe OAuth cleanup path before deleting provider config

If you found this page after searching “Codex OAuth still uses legacy openai-codex provider” or “OpenClaw Codex login keeps falling back after upgrade”, treat the stale override as a configuration incident, not a reason to rotate every credential immediately. Use this low-risk order:

1. record the active agent order and the provider selected at runtime;
2. confirm whether a legacy openai-codex override exists in the agent, workspace, or global config layer;
3. move the stale override aside instead of deleting the whole auth directory;
4. rerun OAuth for the intended Codex provider and verify one read-only task before background jobs resume;
5. keep the before/after provider resolution output with the upgrade note.

This path is meant for operators who need Codex back online quickly while preserving enough evidence to prove whether the failure was legacy provider precedence, stale OAuth state, or a broader model-routing regression.