{"record":{"id":"71e8fac46c70cd3d","repo":"HKUDS/Vibe-Trading","slug":"openai-codex-oauth-only-supports-https-chatgpt-c","errorCode":null,"errorMessage":"OpenAI Codex OAuth only supports https://chatgpt.com/backend-api/codex/responses","messagePattern":"OpenAI Codex OAuth only supports https://chatgpt\\.com/backend-api/codex/responses","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agent/src/providers/openai_codex.py","lineNumber":395,"sourceCode":"        if refreshed.access == token.access:\n            if not force_refresh and _token_expiry_ms(token) > now_ms:\n                return token\n            _clear_codex_token(storage)\n            raise CodexAuthenticationError(\"The Codex backend rejected the access token and refresh did not replace it\")\n        return refreshed\n\n\ndef validate_codex_base_url(url: str) -> str:\n    \"\"\"Validate the only supported ChatGPT Codex OAuth endpoint.\n\n    ChatGPT OAuth tokens must not be sent to arbitrary OpenAI-compatible base\n    URLs. The standard OpenAI API remains API-key authenticated; this provider\n    is limited to the ChatGPT Codex backend endpoint used by Codex OAuth.\n    \"\"\"\n    value = (url or DEFAULT_CODEX_URL).strip().rstrip(\"/\")\n    parsed = urlparse(value)\n    if parsed.scheme != \"https\" or parsed.netloc != \"chatgpt.com\" or parsed.path != \"/backend-api/codex/responses\":\n        raise ValueError(\"OpenAI Codex OAuth only supports https://chatgpt.com/backend-api/codex/responses\")\n    return value\n\n\ndef _build_headers(account_id: str, access_token: str) -> dict[str, str]:\n    return {\n        \"Authorization\": f\"Bearer {access_token}\",\n        \"chatgpt-account-id\": account_id,\n        \"OpenAI-Beta\": \"responses=experimental\",\n        \"originator\": DEFAULT_ORIGINATOR,\n        \"User-Agent\": \"vibe-trading (python)\",\n        \"accept\": \"text/event-stream\",\n        \"content-type\": \"application/json\",\n    }\n\n\ndef _strip_model_prefix(model: str) -> str:\n    if model.startswith(\"openai-codex/\") or model.startswith(\"openai_codex/\"):\n        return model.split(\"/\", 1)[1]","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/HKUDS/Vibe-Trading/blob/80ffdda44c5c4db0dd84d70e051cca591cea67df/agent/src/providers/openai_codex.py#L377-L413","documentation":"validate_codex_base_url hard-restricts the Codex OAuth provider to the single supported endpoint https://chatgpt.com/backend-api/codex/responses. Any other scheme, host, or path (including the standard api.openai.com URL) is rejected with ValueError because OAuth-based Codex streaming only works against that endpoint.","triggerScenarios":"Setting the Codex base URL setting to api.openai.com, an http:// URL, a proxied host, or any path variant; passing a custom codex_url to OpenAICodexLLM that differs from the allowed endpoint.","commonSituations":"Copy-pasting OPENAI_BASE_URL (API-key endpoint) into the Codex setting; corporate proxies rewriting the host; attempts to point the provider at a self-hosted gateway.","solutions":["Set the URL to exactly https://chatgpt.com/backend-api/codex/responses or leave it empty to use the default","For the standard OpenAI API with custom base URLs, use the openai provider with an API key instead of the Codex OAuth provider","Ensure no trailing path modifications or environment variable overrides rewrite the URL"],"exampleFix":"# before\nset_llm_settings(openai_codex_base_url=\"https://api.openai.com/v1\")\n\n# after\nset_llm_settings(openai_codex_base_url=\"https://chatgpt.com/backend-api/codex/responses\")","handlingStrategy":"validation","validationCode":"from src.providers.openai_codex import validate_codex_base_url\ntry:\n    validate_codex_base_url(cfg.openai_codex_base_url)\nexcept ValueError as e:\n    print('fix config:', e)","typeGuard":"def is_valid_codex_url(url: str) -> bool:\n    p = urlparse((url or '').strip().rstrip('/'))\n    return (p.scheme, p.netloc, p.path) == ('https', 'chatgpt.com', '/backend-api/codex/responses')","tryCatchPattern":"try:\n    llm = OpenAICodexLLM(codex_url=url)\nexcept ValueError as e:\n    print('resetting to default endpoint'); llm = OpenAICodexLLM()","preventionTips":["Leave the Codex URL unset to use the validated default","Use the openai provider for custom base URLs, not the codex provider"],"tags":["codex","url-validation","configuration","oauth"],"backgroundTag":"invalid-base-url","analyzedSha":"80ffdda44c5c4db0dd84d70e051cca591cea67df","analyzedAt":"2026-08-28T12:46:38.989Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}