HKUDS/Vibe-Trading · error · ValueError

OpenAI Codex OAuth only supports https://chatgpt.com/backend

Error message

OpenAI Codex OAuth only supports https://chatgpt.com/backend-api/codex/responses

What it means

validate_codex_base_url hard-restricts the Codex OAuth provider to the single supported endpoint https://chatgpt.com/backend-api/codex/responses. Any other scheme, host, or path (including the standard api.openai.com URL) is rejected with ValueError because OAuth-based Codex streaming only works against that endpoint.

Source

Thrown at agent/src/providers/openai_codex.py:395

        if refreshed.access == token.access:
            if not force_refresh and _token_expiry_ms(token) > now_ms:
                return token
            _clear_codex_token(storage)
            raise CodexAuthenticationError("The Codex backend rejected the access token and refresh did not replace it")
        return refreshed


def validate_codex_base_url(url: str) -> str:
    """Validate the only supported ChatGPT Codex OAuth endpoint.

    ChatGPT OAuth tokens must not be sent to arbitrary OpenAI-compatible base
    URLs. The standard OpenAI API remains API-key authenticated; this provider
    is limited to the ChatGPT Codex backend endpoint used by Codex OAuth.
    """
    value = (url or DEFAULT_CODEX_URL).strip().rstrip("/")
    parsed = urlparse(value)
    if parsed.scheme != "https" or parsed.netloc != "chatgpt.com" or parsed.path != "/backend-api/codex/responses":
        raise ValueError("OpenAI Codex OAuth only supports https://chatgpt.com/backend-api/codex/responses")
    return value


def _build_headers(account_id: str, access_token: str) -> dict[str, str]:
    return {
        "Authorization": f"Bearer {access_token}",
        "chatgpt-account-id": account_id,
        "OpenAI-Beta": "responses=experimental",
        "originator": DEFAULT_ORIGINATOR,
        "User-Agent": "vibe-trading (python)",
        "accept": "text/event-stream",
        "content-type": "application/json",
    }


def _strip_model_prefix(model: str) -> str:
    if model.startswith("openai-codex/") or model.startswith("openai_codex/"):
        return model.split("/", 1)[1]

View on GitHub (pinned to 80ffdda44c)

Solutions

Set the URL to exactly https://chatgpt.com/backend-api/codex/responses or leave it empty to use the default
For the standard OpenAI API with custom base URLs, use the openai provider with an API key instead of the Codex OAuth provider
Ensure no trailing path modifications or environment variable overrides rewrite the URL

Example fix

# before
set_llm_settings(openai_codex_base_url="https://api.openai.com/v1")

# after
set_llm_settings(openai_codex_base_url="https://chatgpt.com/backend-api/codex/responses")

Defensive patterns

Strategy: validation

Validate before calling

from src.providers.openai_codex import validate_codex_base_url
try:
    validate_codex_base_url(cfg.openai_codex_base_url)
except ValueError as e:
    print('fix config:', e)

Type guard

def is_valid_codex_url(url: str) -> bool:
    p = urlparse((url or '').strip().rstrip('/'))
    return (p.scheme, p.netloc, p.path) == ('https', 'chatgpt.com', '/backend-api/codex/responses')

Try / catch

try:
    llm = OpenAICodexLLM(codex_url=url)
except ValueError as e:
    print('resetting to default endpoint'); llm = OpenAICodexLLM()

Prevention

Leave the Codex URL unset to use the validated default
Use the openai provider for custom base URLs, not the codex provider

When it happens

Trigger: Setting the Codex base URL setting to api.openai.com, an http:// URL, a proxied host, or any path variant; passing a custom codex_url to OpenAICodexLLM that differs from the allowed endpoint.

Common situations: Copy-pasting OPENAI_BASE_URL (API-key endpoint) into the Codex setting; corporate proxies rewriting the host; attempts to point the provider at a self-hosted gateway.

Related errors

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/71e8fac46c70cd3d. Report an issue: GitHub.