router-for-me/CLIProxyAPI · error

OAuth error: %s

Error message

OAuth error: %s

What it means

The Codex OAuth callback received an error query parameter: the authorization server (ChatGPT/Codex OAuth) rejected the request and redirected with ?error=... per OAuth2 RFC 6749. The handler logs it, forwards OAuthResult{Error: errorParam} to the waiting login flow, and returns HTTP 400 "OAuth error: <errorParam>".

Source

Thrown at internal/auth/codex/oauth_server.go:187

	if r.Method != http.MethodGet {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}

	// Extract parameters
	query := r.URL.Query()
	code := query.Get("code")
	state := query.Get("state")
	errorParam := query.Get("error")

	// Validate required parameters
	if errorParam != "" {
		log.Errorf("OAuth error received: %s", errorParam)
		result := &OAuthResult{
			Error: errorParam,
		}
		s.sendResult(result)
		http.Error(w, fmt.Sprintf("OAuth error: %s", errorParam), http.StatusBadRequest)
		return
	}

	if code == "" {
		log.Error("No authorization code received")
		result := &OAuthResult{
			Error: "no_code",
		}
		s.sendResult(result)
		http.Error(w, "No authorization code received", http.StatusBadRequest)
		return
	}

	if state == "" {
		log.Error("No state parameter received")
		result := &OAuthResult{
			Error: "no_state",
		}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Inspect the error code: access_denied → user declined, retry and approve; invalid_scope/invalid_client → fix the client registration or scopes
2. Re-run the login command; the failed result is already propagated to the CLI which will print the reason
3. Verify account/org permissions for the Codex CLI app on the provider side

// provider-side error; nothing to pre-validate locally. After the flow:
result, err := server.WaitForCode(ctx)
if err == nil && result.Error != "" { switch result.Error {
    case "access_denied": /* user denied; retry login */
    default: /* surface result.Error, check client registration */
} }

func oauthFailed(r *OAuthResult) bool { return r != nil && r.Error != "" }

result, err := server.WaitForCode(ctx)
if err != nil { return fmt.Errorf("oauth wait: %w", err) }
if result.Error != "" { return fmt.Errorf("codex oauth error: %s", result.Error) }

When it happens

Trigger: Redirect to /callback?error=access_denied after the user denies consent; ?error=invalid_request/invalid_scope/invalid_client from a malformed or misregistered authorization request during `codex login`.

Common situations: User cancels the OpenAI/ChatGPT consent page; org policies blocking the app; expired or revoked client credentials; requesting scopes the Codex client is not entitled to.

Related errors

• timeout waiting for OAuth callback
• OAuth error: %s
• Method not allowed
• No authorization code received
• missing access_token and refresh_token

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/827e2ede01feb787. Report an issue: GitHub.