unslothai/unsloth · error · CodexAuthError

Device authorization failed. Enable device-code login in Cha

Error message

Device authorization failed. Enable device-code login in ChatGPT settings and retry.

What it means

Raised as CodexAuthError in the device-code polling loop when the token endpoint returns a terminal (non-pending, non-slow_down) error. Only deviceauth_authorization_pending and slow_down/429 are treated as continue conditions; every other error or status >= 400 aborts device login with this message. The text specifically points at the most common root cause: device-code login being disabled for the ChatGPT account.

Source

Thrown at studio/backend/core/inference/openai_codex_auth.py:454

                try:
                    error_body = response.json()
                    error = error_body.get("error")
                    error_code = (
                        error.get("code", "") if isinstance(error, dict) else str(error or "")
                    )
                    server_interval = error_body.get("interval")
                except Exception:
                    pass
                if error_code == "deviceauth_authorization_pending":
                    continue
                if error_code == "slow_down" or response.status_code == 429:
                    try:
                        requested = float(server_interval)
                    except (TypeError, ValueError):
                        requested = flow.interval + 5
                    flow.interval = min(30.0, max(flow.interval + 5, requested))
                    continue
                raise CodexAuthError(
                    "Device authorization failed. Enable device-code login in ChatGPT settings and retry."
                )
            body = response.json()
            code = body.get("authorization_code")
            verifier = body.get("code_verifier")
            if (
                not isinstance(code, str)
                or not code
                or not isinstance(verifier, str)
                or not verifier
            ):
                raise CodexAuthError("ChatGPT returned an invalid device authorization response.")
            await _exchange_code(
                flow,
                code,
                verifier = verifier,
                redirect_uri = OPENAI_CODEX_DEVICE_REDIRECT_URI,
            )

View on GitHub (pinned to 203007d190)

Solutions

Enable device-code login in ChatGPT settings (the error text names this directly) and retry the device flow.
If the device code expired (user waited too long), restart the flow and approve promptly at the verification URL.
Fall back to the browser loopback flow when device login is administratively unavailable.
If it persists after enabling, log the actual error_code from the response to identify the exact server rejection.

Example fix

// before
flow = await codex_auth.start_device_flow(provider_id, persist_bundle)
# user approves late; device code expired; polling raises and flow dies

// after
try:
    flow = await codex_auth.start_device_flow(provider_id, persist_bundle)
except codex_auth.CodexAuthError as exc:
    if "device-code login" in str(exc):
        flow = await codex_auth.start_browser_flow(provider_id, persist_bundle)  # fallback path

Defensive patterns

Strategy: fallback

Type guard

def is_device_flow_error(exc: BaseException) -> bool:
    return isinstance(exc, codex_auth.CodexAuthError) and "device-code login" in str(exc)

Try / catch

try:
    flow = await start_device_flow(provider_id, persist_bundle)
except codex_auth.CodexAuthError as exc:
    if "device-code login" in str(exc):
        flow = await start_browser_flow(provider_id, persist_bundle)  # fallback
    else:
        raise

Prevention

Enable device-code login in ChatGPT account settings before choosing the device flow.
Approve the device prompt at the verification URL promptly — codes expire.
Offer the browser flow as an automatic alternative.
Log the upstream error_code to distinguish 'disabled' from 'expired token'.

When it happens

Trigger: Polling OPENAI_CODEX_TOKEN_URL during device flow and receiving errors such as 'deviceauth_access_denied', 'expired_token' (device code timed out), 'invalid_client', or any unrecognized error code while grant_type is the device authorization exchange.

Common situations: ChatGPT account/plan does not have device-code login enabled (work/edu accounts where it is admin-disabled); the user waited past the device code expiry before approving; OpenAI disables the codex device grant for the account; server-side policy changes to the device authorization endpoint.

Related errors

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/5ab749d3abbd42c6. Report an issue: GitHub.