unslothai/unsloth · error · CodexAuthError

ChatGPT returned an invalid device authorization response.

Error message

ChatGPT returned an invalid device authorization response.

What it means

Raised as CodexAuthError at the end of the device polling loop when the server returns success but the JSON body's 'authorization_code' or 'code_verifier' fields are missing, not strings, or empty. This is a response-shape validation: the device grant in this design returns a pre-traded authorization code plus its PKCE verifier, and both must be present and non-empty before _exchange_code is attempted.

Source

Thrown at studio/backend/core/inference/openai_codex_auth.py:466

                    try:
                        requested = float(server_interval)
                    except (TypeError, ValueError):
                        requested = flow.interval + 5
                    flow.interval = min(30.0, max(flow.interval + 5, requested))
                    continue
                raise CodexAuthError(
                    "Device authorization failed. Enable device-code login in ChatGPT settings and retry."
                )
            body = response.json()
            code = body.get("authorization_code")
            verifier = body.get("code_verifier")
            if (
                not isinstance(code, str)
                or not code
                or not isinstance(verifier, str)
                or not verifier
            ):
                raise CodexAuthError("ChatGPT returned an invalid device authorization response.")
            await _exchange_code(
                flow,
                code,
                verifier = verifier,
                redirect_uri = OPENAI_CODEX_DEVICE_REDIRECT_URI,
            )
            return
        except asyncio.CancelledError:
            return
        except CodexAuthError as exc:
            flow.status = "error"
            flow.message = str(exc)

            await _persist_terminal_flow(flow)
            return
        except Exception:
            flow.status = "error"
            flow.message = "Device authorization failed. Please retry."

View on GitHub (pinned to 203007d190)

Solutions

Retry the device flow once — transient malformed responses during rollouts do happen.
Upgrade the Studio/library version so the parser matches the current OpenAI device-grant response shape.
If persistent, capture the raw response body and compare field names against OpenAI's current codex device auth contract.
Use the browser flow as a working alternative while device auth is broken.

Example fix

// before
code = body.get("authorization_code")
verifier = body.get("code_verifier")

// after
# defensive read matching current contract, then explicit validation
code = body.get("authorization_code") or body.get("auth_code")
verifier = body.get("code_verifier") or body.get("verifier")
if not isinstance(code, str) or not code or not isinstance(verifier, str) or not verifier:
    raise CodexAuthError("ChatGPT returned an invalid device authorization response.")

Defensive patterns

Strategy: retry

Type guard

def is_device_response_error(exc: BaseException) -> bool:
    return isinstance(exc, codex_auth.CodexAuthError) and "invalid device authorization response" in str(exc)

Try / catch

for attempt in range(2):
    try:
        return await run_device_flow(provider_id)
    except codex_auth.CodexAuthError as exc:
        if "invalid device authorization response" in str(exc) and attempt == 0:
            continue  # transient schema/rollout hiccup; retry once
        raise

Prevention

Keep the library version current with OpenAI's device-grant response schema.
Retry once on malformed success responses; treat persistence as a contract change.
Verify raw response bodies when integrating in test environments.
Keep the browser flow available as an alternative when device auth misbehaves.

When it happens

Trigger: The device token endpoint returns 200 with a body lacking authorization_code or code_verifier, containing null for either, or returning them as non-string types; an upstream API contract change renames the fields.

Common situations: OpenAI changes the device-grant response schema (e.g. renaming to auth_code); partial proxy responses truncating JSON; server bugs during gradual rollouts; version mismatch between this library's expectations and the live endpoint.

Related errors

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/fd305dfb25410213. Report an issue: GitHub.