macOS: OAuth token exchange fails with "error sending request" while curl to the same /oauth/token endpoint succeeds

What version of the Codex App are you using (From “About Codex” dialog)?

26.825.32147

What subscription do you have?

Summary Codex CLI authentication consistently fails on macOS during the OAuth token exchange step. The browser authentication flow completes successfully and the callback to localhost:1455 works, but Codex fails when exchanging the authorization code at: https://auth.openai.com/oauth/token with: text Token exchange error: error sending request for url (https://auth.openai.com/oauth/token) Error logging in: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token) The important part is that curl from the same Mac, using the same network path, can successfully connect to the exact same /oauth/token endpoint, complete TLS, and receive a valid HTTP response from OpenAI. This is reproducible on both Codex CLI 0.149.0 and 0.148.0. --- ## Environment - OS: macOS Sonoma 14.1 - Architecture: Apple Silicon / arm64 - Codex CLI tested: - 0.149.0 - 0.148.0 - Network routing: Clash Verge Rev using TUN / virtual network interface mode - Exit location: United States (San Jose) - Browser authentication: works - localhost OAuth callback: works - Direct HTTPS access to OpenAI auth endpoint through the same TUN route: works --- ## Steps to reproduce Run: bash codex login Codex starts the local callback server normally: text Starting local login server on http://localhost:1455. If your browser did not open, navigate to this URL to authenticate: https://auth.openai.com/oauth/authorize?... Complete authentication in the browser. The browser flow succeeds and returns to the localhost callback, but the final token exchange fails: text Token exchange error: error sending request for url (https://auth.openai.com/oauth/token) Error logging in: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token) The browser page shows: text Sign-in could not be completed Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token) Error code: token_exchange_failed --- ## Important comparison: curl succeeds to the same endpoint Without specifying an HTTP proxy, SOCKS proxy, or curl -x option, I tested the same endpoint: bash curl -v --max-time 15 \ https://auth.openai.com/oauth/token \ -d 'grant_type=test' The connection succeeds: text Trying 198.18.0.68:443... Connected to auth.openai.com (198.18.0.68) port 443 SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 ALPN: server accepted h2 Server certificate: subject: CN=auth.openai.com subjectAltName: host "auth.openai.com" matched cert's "auth.openai.com" issuer: C=US; O=Google Trust Services; CN=WE1 SSL certificate verify ok. The request reaches OpenAI and receives: text HTTP/2 400 server: cloudflare openai-version: 2020-10-01 cf-ray: ...-SJC with the expected application-level response: json { "error": { "message": "Invalid value: 'test'. Supported values are: 'authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:token-exchange', and 'urn:ietf:params:oauth:grant-type:jwt-bearer'.", "type": "invalid_request_error", "param": "grant_type", "code": "invalid_value" } } Therefore the same machine can successfully: 1. resolve/reroute auth.openai.com, 2. establish the TCP connection, 3. complete TLS certificate verification, 4. negotiate HTTP/2, 5. POST to /oauth/token, 6. receive a normal response from the OpenAI authentication service. Codex nevertheless reports: text error sending request for url (https://auth.openai.com/oauth/token) --- ## TUN / routing details The machine is using Clash Verge Rev in TUN (virtual network interface) mode. This is transparent network-layer routing; Codex does not need to explicitly support an HTTP or SOCKS proxy. The 198.18.x.x address shown by curl is the Fake-IP used by the TUN/Mihomo routing configuration. Normal curl traffic is successfully intercepted and routed through the TUN. No explicit proxy arguments are required for the successful curl test. --- ## Proxy troubleshooting already performed Before switching to TUN, I also tested explicit SOCKS5 routing. For example: bash curl --socks5-hostname 127.0.0.1:1080 \ -X POST \ https://auth.openai.com/oauth/token \ -d 'grant_type=test' \ -v This also successfully reached OpenAI and returned the expected HTTP 400 response. I additionally tested an HTTP proxy bridge (Privoxy -> SOCKS5). A curl POST through that HTTP proxy also successfully reached /oauth/token. Codex authentication still failed. I have therefore reproduced successful access to /oauth/token using: - explicit SOCKS5 - HTTP proxy -> SOCKS5 - transparent Clash/Mihomo TUN routing while Codex continues to fail during token exchange. --- ## Proxy environment variables I also tested after clearing proxy environment variables: bash unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY unset http_proxy https_proxy all_proxy no_proxy launchctl unsetenv HTTP_PROXY launchctl unsetenv HTTPS_PROXY launchctl unsetenv ALL_PROXY launchctl unsetenv NO_PROXY Codex still fails. I also previously tried: bash ALL_PROXY=socks5h://127.0.0.1:1080 \ NO_PROXY=localhost,127.0.0.1,::1 \ codex login --device-auth Device authentication also failed while trying to access the OpenAI authentication service. --- ## Version downgrade test The issue originally reproduced with: text codex-cli 0.149.0 I downgraded the standalone CLI to: text codex-cli 0.148.0 and repeated: bash codex login The result is unchanged: text Token exchange error: error sending request for url (https://auth.openai.com/oauth/token) Error logging in: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token) So this does not appear to be specific to 0.149.0. --- ## Debug logging I also tried: bash RUST_BACKTRACE=1 \ RUST_LOG=trace \ codex login 2>&1 | tee ~/Desktop/codex-login-trace.txt but the CLI did not expose a more specific underlying reqwest/hyper/TLS/connect error. It still only reported: text Token exchange error: error sending request for url (https://auth.openai.com/oauth/token) Error logging in: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token) It would be very helpful if Codex logged the underlying error/source chain here (DNS, TCP, TLS, proxy, certificate, etc.) rather than only error sending request for url. --- ## Expected behavior After successful browser authentication and localhost callback, Codex should successfully POST the authorization-code exchange request to: text https://auth.openai.com/oauth/token and complete login. --- ## Actual behavior Browser authentication succeeds, but Codex itself fails while sending the token exchange request: text Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token) even though curl on the same machine and same network route can successfully POST to that exact endpoint. --- ## Additional observation This looks like a difference between the HTTP/network stack used by Codex and curl rather than basic reachability of auth.openai.com. The most useful diagnostic improvement would be exposing the complete underlying Rust/reqwest error chain for the failed token request.

What platform is your computer?

No response

What issue are you seeing?

Codex OAuth login fails on macOS at the token exchange step with "error sending request for url (https://auth.openai.com/oauth/token)". Browser auth and localhost callback succeed, and curl to the same endpoint works from the same Mac/network. Reproduced on Codex CLI 0.149.0 and 0.148.0.

What steps can reproduce the bug?

1. On macOS, enable normal Internet access. In my case, traffic is routed through Clash Verge Rev using TUN mode.

2. Verify that the OpenAI OAuth token endpoint is reachable from the same Mac:

   curl -v --max-time 15 https://auth.openai.com/oauth/token -d 'grant_type=test'

   The request successfully connects, completes TLS verification, and receives an HTTP 400 response from OpenAI with "invalid_value", which confirms that the endpoint is reachable.

3. Run:

   codex login

4. Codex starts the local OAuth server on:

   http://localhost:1455

5. Complete the OpenAI authentication flow in the browser.

6. The browser successfully returns to the localhost callback, but Codex fails during the token exchange with:

   Token exchange error: error sending request for url (https://auth.openai.com/oauth/token)

   Error logging in: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

7. Repeat the test with Codex CLI 0.148.0 and 0.149.0.

Result: both versions fail at the same OAuth token exchange step, while curl to the same endpoint succeeds from the same Mac and network.

What is the expected behavior?

No response

Additional information

No response

Start with the OAuth flow invoked by codex login, focusing on the token exchange request to https://auth.openai.com/oauth/token and its Rust/reqwest error handling. Reproduce on macOS with the reported TUN setup and compare the CLI failure with the successful curl request. Done means login completes or the underlying DNS, TCP, TLS, proxy, or certificate error is exposed clearly.