unslothai/unsloth · error · CodexAuthError

ChatGPT authorization failed. Please reconnect.

Error message

ChatGPT authorization failed. Please reconnect.

What it means

Raised as CodexAuthError when a POST to the OAuth token endpoint returns HTTP >= 400 but the error is NOT one of the known refresh-token failure codes (or the request was not a refresh_token grant at all). It is the generic terminal failure for token exchange and refresh: bad authorization codes, wrong client_id/redirect_uri, malformed requests, or unrecognized server error codes all land here.

Source

Thrown at studio/backend/core/inference/openai_codex_auth.py:281

            response = await client.post(OPENAI_CODEX_TOKEN_URL, data = data)
    except httpx.HTTPError as exc:
        raise CodexAuthError("Could not reach ChatGPT authentication.") from exc
    if response.status_code >= 400:
        error_code = ""
        try:
            error = response.json().get("error")
            error_code = error.get("code", "") if isinstance(error, dict) else str(error or "")
        except Exception:
            pass
        if data.get("grant_type") == "refresh_token" and error_code in {
            "invalid_grant",
            "invalid_refresh_token",
            "refresh_token_expired",
        }:
            raise CodexReauthorizationRequired(
                "ChatGPT authorization is no longer valid. Please reconnect."
            )
        raise CodexAuthError("ChatGPT authorization failed. Please reconnect.")
    try:
        return response.json()
    except Exception as exc:
        raise CodexAuthError("ChatGPT returned an invalid authorization response.") from exc


async def _exchange_code(
    flow: OAuthFlow,
    code: str,
    *,
    verifier: str | None = None,
    redirect_uri: str | None = None,
) -> None:
    if flow.consumed:
        raise CodexAuthError("Authorization callback was already used.")
    flow.consumed = True
    try:
        body = await _token_request(

View on GitHub (pinned to 203007d190)

Solutions

  1. Start a fresh authorization flow (old codes and verifiers are single-use); do not retry the same code.
  2. Verify the authorization request and token request used the same redirect_uri and that the full callback URL (including query string) was used.
  3. Inspect response body logging (temporarily) to read the actual error code from OpenAI and map it to the cause.
  4. Confirm OPENAI_CODEX_CLIENT_ID and token endpoint constants are current for your library version.

Example fix

// before
body = await _token_request({
    "grant_type": "authorization_code",
    "client_id": OPENAI_CODEX_CLIENT_ID,
    "code": code_from_user_input.strip().split("?")[0],  # truncated code
    ...
})

// after
body = await _token_request({
    "grant_type": "authorization_code",
    "client_id": OPENAI_CODEX_CLIENT_ID,
    "code": code,  # full, unmodified code taken from the exact callback URL
    ...
})
Defensive patterns

Strategy: try-catch

Type guard

def is_codex_auth_error(exc: BaseException) -> bool:
    return isinstance(exc, codex_auth.CodexAuthError) and not isinstance(
        exc, codex_auth.CodexReauthorizationRequired
    )

Try / catch

try:
    await codex_auth.complete_browser_flow(provider_id, flow_id, callback_url)
except codex_auth.CodexAuthError as exc:
    if isinstance(exc, codex_auth.CodexReauthorizationRequired):
        raise  # different remedy: reconnect
    show_error("Authorization failed, please start a new connection.")

Prevention

When it happens

Trigger: Calling _token_request/_exchange_code with an invalid, already-used, or expired authorization_code; a redirect_uri that does not match the one used at consent; a PKCE code_verifier that does not match the challenge; the server returning an error object with an unexpected code such as 'invalid_client' or 'unauthorized_client'; any 5xx from auth.openai.com during token exchange.

Common situations: The user copied only part of the callback URL so the code is truncated; the authorization flow was started in one process and completed in another so the PKCE verifier is missing; OpenAI changed the client id or endpoint constants; a proxy or auth library mangles the request body; clock skew or replayed codes after a retry.

Related errors

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/7c86e145d75a2be1. Report an issue: GitHub.