unslothai/unsloth · error · CodexTransportError

ChatGPT Codex endpoint returned a forbidden redirect.

Error message

ChatGPT Codex endpoint returned a forbidden redirect.

What it means

The Codex backend HTTP client treats any 3xx redirect as a transport error because the ChatGPT Codex responses endpoint is not supposed to redirect. A redirect here usually means the request never reached the real API: an intercepting proxy, captive portal, wrong base URL, or region-block returned a redirect page instead of the endpoint.

Source

Thrown at studio/backend/core/inference/openai_codex_client.py:362

    for attempt in range(_MAX_TRANSIENT_RETRIES + 1):
        yielded = False
        try:
            async with _stream_response(
                client,
                url = url,
                headers = headers,
                body = body,
                cancel_event = cancel_event,
            ) as response:
                if response is None:
                    yield None
                    return
                if 200 <= response.status_code < 300:
                    yielded = True
                    yield response
                    return
                if 300 <= response.status_code < 400:
                    raise CodexTransportError(
                        "ChatGPT Codex endpoint returned a forbidden redirect."
                    )
                detail = await _upstream_error_detail(response)
                if response.status_code == 401 and refresh_access is not None and not refreshed:
                    try:
                        token, account_id = await refresh_access()
                    except CodexReauthorizationRequired as exc:
                        raise CodexReauthorizationError(
                            "ChatGPT authorization expired. Reconnect this connection.",
                            status = 401,
                            metadata = {"access_token": token},
                        ) from exc
                    except Exception as exc:
                        raise CodexTransportError(
                            "Could not refresh ChatGPT authorization. Please retry.",
                            status = 502,
                        ) from exc
                    headers["Authorization"] = f"Bearer {token}"

View on GitHub (pinned to 203007d190)

Solutions

  1. Check proxy configuration: bypass or correctly authenticate the proxy for the Codex endpoint domain
  2. Verify the configured Codex base URL is the direct API endpoint, not a portal/login host
  3. Reproduce with curl -v --max-redirs 0 against the endpoint to see where the redirect points
  4. If on captive/filtered networks, connect from an unrestricted network to confirm

Example fix

# before
export HTTPS_PROXY=http://proxy.corp:3128  # proxy 302s API calls to a login page

# after
export HTTPS_PROXY=http://proxy.corp:3128
export NO_PROXY=chatgpt.com,api.openai.com  # bypass proxy for the Codex endpoint
Defensive patterns

Strategy: validation

Validate before calling

import socket, urllib.parse
host = urllib.parse.urlparse(CODEX_BASE_URL).hostname
assert socket.gethostbyname(host), 'DNS fails for Codex endpoint'
# smoke test: endpoint must not redirect
import httpx
r = httpx.post(CODEX_BASE_URL, follow_redirects=False, timeout=5,
               headers={'Authorization': 'Bearer x'})
if 300 <= r.status_code < 400:
    raise EnvironmentError('Proxy/network redirects Codex traffic — fix egress')

Try / catch

try:
    async for chunk in stream:
        ...
except CodexTransportError as exc:
    if 'forbidden redirect' in str(exc):
        run_network_diagnostics_and_warn_user()
        return
    raise

Prevention

When it happens

Trigger: POST/GET to the Codex responses endpoint returns a status in 300..399 (httpx redirects are disabled or the redirect crosses methods). Typical with corporate SSL-inspection proxies, a misconfigured base URL pointing at a login page, or DNS hijacking.

Common situations: Corporate proxy that redirects API traffic to an auth page; HTTPS_PROXY/HTTP_PROXY env vars set to a proxy that blocks chatgpt.com; custom base URL configured to a domain that 302s; captive-portal WiFi; region where the endpoint is blocked.

Understand the failure class

Related errors

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/a65c4264355724f7. Report an issue: GitHub.