Codex CLI 0.151.0 fails at OAuth token exchange.

What version of Codex CLI is running?

0.151.0

What subscription do you have?

plus

Which model were you using?

sol5.6

What platform is your computer?

Linux distro: CachyOS

What terminal emulator and version are you using (if applicable)?

kitty and zsh and tmux

Codex doctor report

What issue are you seeing?

Hi, here are the requested details:

Codex CLI version: 0.151.0
Linux distro: CachyOS
Most recent failure time: 2026-08-31 01:21:44 ICT (UTC+7)
I checked for workload-identity environment variables with:

env | egrep 'OPENAI_IDENTITY_TOKEN_FILE|OPENAI_WORKLOAD_IDENTITY_'

There was no output, so neither OPENAI_IDENTITY_TOKEN_FILE nor any OPENAI_WORKLOAD_IDENTITY_* variables are set in the Codex process environment.

I also checked the OpenAI status page and do not see an active authentication-related incident at the time of testing.

The issue is still reproducible. Browser OAuth succeeds and the localhost callback is valid, but Codex fails during the outbound token exchange with:

is_timeout=false is_connect=true is_request=true

Please continue routing/escalating Case 14026949 to the appropriate Codex team.

What steps can reproduce the bug?

Codex CLI: 0.151.0
Linux distro: CachyOS
Most recent failure: 2026-08-31 01:21:44 ICT (UTC+7)
No OPENAI_IDENTITY_TOKEN_FILE or OPENAI_WORKLOAD_IDENTITY_* environment variables are set.

The issue remains reproducible after testing proxy settings, mobile hotspot, IPv6, CA bundle overrides, reinstalling Codex, and multiple Codex versions.

Browser OAuth and localhost callback succeed, but Codex fails at the outbound token exchange with:

is_timeout=false is_connect=true is_request=true

Please escalate the existing case to the Codex engineering team.

What is the expected behavior?

Additional information

curl -sS -o /dev/null -D -
-X POST https://auth.openai.com/oauth/token
--data 'grant_type=test' |
rg -i 'HTTP/|server:|cf-'
HTTP/2 400
server: cloudflare
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.1,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=udYxPPhchlOv%2BUURebURyj9Z304VCmBG7I95cl2s%2FNWBPeKDdkyWWdGSsnX6s7XlxGIX9RxhlQU9JKg8%2F4UbX9Q6vEtOEwHkOIKuqO8FroCQxsy0ZniGFU5h5lMgE8ZYRHIWttQkeGh0HUBxew%3D%3D"}]}
cf-ray: a33686da8cadf5a0-BKK

Start by reproducing Codex CLI 0.151.0 authentication on CachyOS and tracing the outbound POST to auth.openai.com/oauth/token after the browser callback succeeds. Compare the successful callback with the token-exchange failure and existing case 14026949; done means OAuth login completes without the reported connection error.