unslothai/unsloth · error · CodexAuthError

Could not reach ChatGPT authentication.

Error message

Could not reach ChatGPT authentication.

What it means

CodexAuthError raised by _token_request when POSTing to OPENAI_CODEX_TOKEN_URL raises an httpx.HTTPError — connect failure, timeout (client timeout is 30s), TLS error, etc. The client is configured with follow_redirects=False and trust_env=False, so it deliberately ignores proxy env vars; environments that require an egress proxy will fail to reach the auth host directly.

Source

Thrown at studio/backend/core/inference/openai_codex_auth.py:265


def auth_status(provider_id: str) -> str:
    bundle = load_oauth_bundle(provider_id)
    if not bundle:
        return "disconnected"
    # An expired access token is still usable after refresh. Only a permanent
    # refresh rejection should ask the user to reconnect.
    return "reauthorization_required" if bundle.get("reauthorization_required") else "connected"


async def _token_request(data: dict[str, Any]) -> dict[str, Any]:
    try:
        async with httpx.AsyncClient(
            timeout = 30.0, follow_redirects = False, trust_env = False
        ) as client:
            response = await client.post(OPENAI_CODEX_TOKEN_URL, data = data)
    except httpx.HTTPError as exc:
        raise CodexAuthError("Could not reach ChatGPT authentication.") from exc
    if response.status_code >= 400:
        error_code = ""
        try:
            error = response.json().get("error")
            error_code = error.get("code", "") if isinstance(error, dict) else str(error or "")
        except Exception:
            pass
        if data.get("grant_type") == "refresh_token" and error_code in {
            "invalid_grant",
            "invalid_refresh_token",
            "refresh_token_expired",
        }:
            raise CodexReauthorizationRequired(
                "ChatGPT authorization is no longer valid. Please reconnect."
            )
        raise CodexAuthError("ChatGPT authorization failed. Please reconnect.")
    try:
        return response.json()

View on GitHub (pinned to 203007d190)

Solutions

  1. Check basic connectivity: curl -sS https://auth.openai.com (or the configured token URL) from the same host/container.
  2. If a proxy is mandatory, ensure the deployment actually allows direct egress to the auth domain, since httpx here ignores proxy env vars by design (trust_env=False).
  3. Retry with backoff for transient timeouts/outages; a persistent failure indicates firewall/DNS, not the app.

Example fix

# before: proxied env, no direct egress
bundle = await _token_request(data)  # httpx.HTTPError -> CodexAuthError

# after: allow direct egress to the auth host (firewall/proxy exception), then
bundle = await _token_request(data)
Defensive patterns

Strategy: retry

Validate before calling

async def auth_endpoint_reachable(timeout: float = 5.0) -> bool:
    try:
        async with httpx.AsyncClient(timeout=timeout, trust_env=False) as c:
            await c.get(OPENAI_CODEX_TOKEN_URL)
        return True
    except httpx.HTTPError:
        return False

Try / catch

for attempt in range(3):
    try:
        return await _token_request(data)
    except CodexAuthError as e:
        if 'Could not reach' in str(e) and attempt < 2:
            await asyncio.sleep(2 ** attempt)
            continue
        raise

Prevention

When it happens

Trigger: Any network-level failure hitting the token endpoint: DNS resolution failure, connection refused, 30s timeout, TLS certificate error. Because trust_env=False, HTTP(S)_PROXY/ALL_PROXY settings are ignored — direct connectivity to auth.openai.com is required.

Common situations: Corporate proxy environments where direct egress is blocked; transient internet outages; DNS issues; firewall blocking the auth domain; slow networks exceeding the 30s timeout.

Understand the failure class

Related errors

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/b6f120b3b0095021. Report an issue: GitHub.