VS Code Codex login fails due to Cloudflare challenge on non-browser requests

What version of the IDE extension are you using?

26.825.51511

What subscription do you have?

Enterprise

Which IDE are you using?

Visual Studio Code

What platform is your computer?

Windows, corporate-managed PC

What issue are you seeing?

Codex is currently unusable in VS Code.

Chat requests fail with:

unexpected status 404 Not Found: Unknown error
url: https://chatgpt.com/backend-api/codex/responses

After signing out, I am unable to sign back in. I have seen both:

Route Error (500 Internal Server Error): {
"isTrusted": true
}

and a Cloudflare 504 Gateway Time-out.

The Codex output shows:

account_login_completed onboardingEntrypoint=null success=false

and:

https://chatgpt.com/backend-api/plugins/featured?platform=codex
-> 401 Unauthorized

Network testing suggests that Cloudflare is challenging non-browser / Codex-like requests.

Normal curl requests to both https://auth.openai.com and https://chatgpt.com return:

HTTP/1.1 403 Forbidden
Cf-Mitigated: challenge
Server: cloudflare

The same happens with a reqwest-like User-Agent.

However, the exact same URLs return HTTP/1.1 200 OK when using a Chrome-like User-Agent.

This appears to prevent the Codex authentication flow and subsequent backend requests from completing successfully.

What steps can reproduce the bug?

Open Codex in VS Code.
Start a new chat and send a prompt.
Request fails with 404 Not Found on https://chatgpt.com/backend-api/codex/responses.
Sign out of Codex and attempt to sign in again.
Login fails with either a Route Error 500 or Cloudflare 504 Gateway Timeout.
Run:
curl.exe -I https://auth.openai.com
curl.exe -I https://chatgpt.com

Both return:

HTTP/1.1 403 Forbidden
Cf-Mitigated: challenge
Run:
curl.exe -I -A "reqwest/0.12.0" https://auth.openai.com
curl.exe -I -A "reqwest/0.12.0" https://chatgpt.com

Both also return 403 Forbidden with Cf-Mitigated: challenge.

Run the same requests with a Chrome-like User-Agent:
curl.exe -I -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" https://auth.openai.com

and:

curl.exe -I -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" https://chatgpt.com

Both return:

HTTP/1.1 200 OK

The behavior is the same over IPv4 and IPv6.

What is the expected behavior?

Codex should complete the ChatGPT authentication flow successfully and access the Codex backend without Cloudflare challenging its non-browser HTTP requests.

Additional information

Corporate-managed Windows PC, but connected through private home Wi-Fi.
No WinHTTP proxy is configured.
No HTTP_PROXY or HTTPS_PROXY environment variables are set.
IPv4 and IPv6 are both affected.
TLS connectivity to auth.openai.com succeeds.
I already tried switching models, starting a new Codex chat, signing out and back in, and resetting the local cap_sid file.
Chrome-like requests succeed while normal curl and reqwest-like requests are challenged by Cloudflare.

Start by reproducing the failure in the VS Code Codex flow, then run the listed curl requests against auth.openai.com and chatgpt.com with the reqwest-like and Chrome-like User-Agents. Trace the authentication and /backend-api/codex/responses requests to determine whether the challenge can be handled within Codex; done means sign-in completes and chat requests succeed without the reported 401, 404, 500, or 504 errors.