OpenAI Codex CLI error
Codex CLI: Token exchange failed: token endpoint returned status 403 Forbidden
Token exchange failed: token endpoint returned status 403 ForbiddenStatus: WorkaroundLast verified 3 documented fixes4 sources
What it means
The browser sign-in reached the local callback, but exchanging the authorization code at the OpenAI token endpoint was rejected, so codex login did not finish. A related variant is "Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)" (#5283).
Causes
- Maintainer etraut-openai (#2414): several bugs behind this were fixed; remaining conditions mostly involve network proxies or VPNs.
- Local firewalls or other network settings interfering with the interactive auth flow (maintainer on #5283).
How to fix it
- Fix 1.
Use headless device authentication (maintainer etraut-openai on #5283; official auth docs).
Terminalcodex login --device-auth - Fix 2.
Behind a corporate TLS proxy or private root CA, set CODEX_CA_CERTIFICATE before logging in (official auth docs).
Terminalexport CODEX_CA_CERTIFICATE=/path/to/corporate-root-ca.pem codex login - Fix 3.
Direct codex login runs write a codex-login.log file under your log directory for debugging login failures (official auth docs).
More Codex CLI errors
All 14 Codex CLI errorsstream disconnected before completion: stream closed before response.completedStatus: Workaroundstream disconnected before completion: error sending request for url (https://chatgpt.com/backend-api/codex/responses)Status: OpenError running remote compact task: stream disconnected before completion: error sending request for url (https://chatgpt.com/backend-api/codex/responses/compact)Status: Fixed in releaseSelected model is at capacity. Please try a different model.Status: By designYour access token could not be refreshed because your refresh token was already used. Please log out and sign in again.Status: Fixed in releaseCodex ran out of room in the model's context window. Start a new thread or clear earlier history before retrying.Status: Fixed in releaseError logging in: Port 127.0.0.1:1455 is already in useStatus: WorkaroundMCP client for `playwright` failed to start: program not foundStatus: Fixed in release
Related reading
- Agent Harness Lessons From a 500B-Token Decompile: Give Agents a PASS/FAIL OracleAgent harness lessons from a 500B+ token decompile: a byte-matching PASS/FAIL oracle beat the reviewer agent. How agents cheated it and what to copy.
- Codex CLI Needs Resource Budgets, Not Just Token BudgetsA trending Codex SQLite WAL bug is a useful warning for every local coding agent: logs, disks, background processes, and telemetry paths need budgets too.
- Harness Engineering Makes Tokens a Systems BudgetHarness engineering turns tokens into a systems budget. OpenAI's Codex post and Tokenomics research say agent teams need budgets, receipts, and eval loops.
- Codex CLI 0.163: Instant Steering Is Now the DefaultCodex CLI 0.163.0 makes mid-response steering the default and adds searchable /config and a leader key. What changed and what to check before upgrading.
- Codex 'gpt-5.5 Model Is Not Supported' Error: The FixCodex says gpt-5.5 is not supported with a ChatGPT account because OpenAI retired it from ChatGPT sign-in on October 14. The fix and what still works.
- Codex CLI Background Daemon: How to Turn It OffCodex CLI starts a persistent, self-updating background daemon since 0.157.0. What it does, why it hit Hacker News and the reported workaround to turn it off.
FAQ
What does "Token exchange failed: token endpoint returned status 403 Forbidden" mean in Codex CLI?
The browser sign-in reached the local callback, but exchanging the authorization code at the OpenAI token endpoint was rejected, so codex login did not finish. A related variant is "Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)" (#5283).
How do I fix "Token exchange failed: token endpoint returned status 403 Forbidden"?
There are 3 documented fixes. Start with the first: Use headless device authentication (maintainer etraut-openai on #5283; official auth docs).
Is this Codex CLI error fixed?
Status: Workaround. No release removes the cause. The documented fixes work around it. Affected versions: Reported August 2025 (#2414); related variant on codex-cli 0.46.0 (#5283)
Sources
Last verified against 4 sources: official docs, maintainer replies and release notes.
Newsletter
Fixes for the tools you use, weekly
One email per week. New coding agent releases, what broke, and how developers are working around it.