Profile Order OpenAI Codex Broken | Friends of the Crustacean 🦞🤝 | Page 1

sinful elk Apr 13, 2026, 9:14 AM

#

The latest update has broken my OpenAI Codex logins order. I previously had 5 profiles and in openclaw.json that order is showing however in auth_profiles.json that no longer exists:

it used to have:
"order": {
"openai-codex": [
"openai-codex:XXXX@XX.uk",
"openai-codex:XX@XX.tv",
"openai-codex:XX@XX.tv",
"openai-codex:XX@XX.tv",
"openai-codex:XX@XX.uk"
]
},

pseudo voidBOT Apr 13, 2026, 9:14 AM

#

storm hareBOT Apr 13, 2026, 9:14 AM

#

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

pseudo voidBOT Apr 13, 2026, 9:14 AM

#

hollow moatBOT Apr 13, 2026, 9:17 AM

#

Let me check the auth-store/state code too, since this smells like the order moved out of auth-profiles.json rather than disappearing.

#

I think part of this is a storage change, not necessarily lost data.

On current OpenClaw:

auth-profiles.json stores the actual profiles/secrets
auth-state.json stores runtime routing state like order, lastGood, and usageStats

So if you’re only checking auth-profiles.json, it makes sense that order is gone there.

If the real issue is that OpenClaw is no longer honoring your configured Codex profile order, can you paste these?

openclaw --version
openclaw models auth order get --provider openai-codex
openclaw models status --probe

If you want to set the per-agent order explicitly again, the CLI is now:

#

openclaw models auth order set --provider openai-codex <profile1> <profile2> <profile3> ...

Docs:

If openclaw.json still has auth.order.openai-codex and it still is not respected, that does sound like a bug. The --probe output should tell us pretty quickly whether it’s an order issue or a profile-id mismatch.

sinful elk Apr 13, 2026, 9:22 AM

#

i dont want it per agent i want it as default

hollow moatBOT Apr 13, 2026, 9:22 AM

#

Yep, then openclaw.json is the right place.

Use the shared/default config order there:

auth: {
  order: {
    "openai-codex": [
      "openai-codex:XXXX@XX.uk",
      "openai-codex:XX@XX.tv",
      "openai-codex:XX@XX.tv",
      "openai-codex:XX@XX.tv",
      "openai-codex:XX@XX.uk"
    ]
  }
}

#

Current behavior is basically:

openclaw.json → default/shared order
auth-state.json → per-agent override only
auth-profiles.json → profiles/secrets only

So if order disappeared from auth-profiles.json, that part is expected.

If you want the global default to win, make sure there is no per-agent override shadowing it:

openclaw models auth order clear --provider openai-codex

If it still ignores the openclaw.json order after that, paste:

#

openclaw --version
openclaw models status --probe

At that point it’s probably a real bug.

Docs:

sinful elk Apr 13, 2026, 9:29 AM

#

openclaw --version
openclaw models auth order get --provider openai-codex
openclaw models status --probe
OpenClaw 2026.4.11 (769908e)

🦞 OpenClaw 2026.4.11 (769908e)
I keep secrets like a vault... unless you print them in debug logs again.

Agent: main
Provider: openai-codex
Auth state file: ~/.openclaw/agents/main/agent/auth-state.json
Order override: (none)

hollow moatBOT Apr 13, 2026, 9:30 AM

#

Thanks, that narrows it down a lot.

Order override: (none) means main is not using a per-agent override, so it should be falling back to the default/shared auth.order.openai-codex from openclaw.json, which is what you want.

So if the order is still wrong, the most likely issue is this:

the profile IDs in auth.order.openai-codex no longer exactly match the current openai-codex:* keys in auth-profiles.json

That can happen after a login/migration/update if profile IDs got regenerated.

I also don’t see any actual output from:

openclaw models status --probe

That’s the important one here. Can you paste:

#

the full openclaw models status --probe output
the auth.order.openai-codex block from openclaw.json
the openai-codex:* profile IDs from ~/.openclaw/agents/main/agent/auth-profiles.json
(keys only, no secrets)

If those IDs all match exactly and it still ignores the config order, then yeah, I’d call that a real regression in 2026.4.11.

sinful elk Apr 13, 2026, 9:41 AM

#

openclaw models status --probe

🦞 OpenClaw 2026.4.11 (769908e)
iMessage green bubble energy, but for everyone.

│
10:39:50+01:00 [plugins] [lcm] Ignoring sessions matching 1 pattern(s): agent:*:cron:**
10:39:50+01:00 [plugins] [lcm] Plugin loaded (enabled=true, db=/home/hl-metabase/.openclaw/memory/lossless-claw/lcm.db, threshold=0.6)
10:39:50+01:00 [plugins] [lcm] Registered context engine id=lossless-claw (plugins.slots.contextEngine must point to "lossless-claw"; plugin ids alone do not activate a context engine)
10:39:50+01:00 [plugins] [lcm] Compaction summarization model: openai-codex/gpt-5.1-codex-mini (override)
10:40:08+01:00 [plugins] [lcm] afterTurn hook fired sessionKey= sessionId=probe-google-e56fb86b-ab71-4c97-8e7e-515bf2721893 prePrompt=0 totalMessages=2
10:40:08+01:00 [plugins] [lcm] ingestBatch() sessionKey= sessionId=probe-google-e56fb86b-ab71-4c97-8e7e-515bf2721893 count=2 heartbeat=false
10:40:08+01:00 [plugins] [lcm] afterTurn ingested 2/2 message(s) for sessionKey=
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/main/agent
Default : openai-codex/gpt-5.4
Fallbacks (0) : -
Image model : -
Image fallbacks (0): -
Aliases (0) : -
Configured models (9): openai-codex/gpt-5.1, openai-codex/gpt-5.1-codex-max, openai-codex/gpt-5.1-codex-mini, openai-codex/gpt-5.2, openai-codex/gpt-5.2-codex, openai-codex/gpt-5.3-codex, openai-codex/gpt-5.3-codex-spark, openai-codex/gpt-5.4, openai-codex/gpt-5.4-mini

#

Auth overview
Auth store : ~/.openclaw/agents/main/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (3): google-antigravity (1), google-gemini-cli (1), openai-codex (1)

google effective=models.json:AIzaSyCB...0OiqKgU4 | models.json=AIzaSyCB...0OiqKgU4 | source=models.json: ~/.openclaw/agents/main/agent/models.json
google-antigravity effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | google-antigravity:default=OAuth
google-gemini-cli effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | google-gemini-cli:default=OAuth
ollama effective=env:ol...al | env=ol...al | source=env: OLLAMA_API_KEY | models.json=marker(ollama-local) | source=models.json: ~/.openclaw/agents/main/agent/models.json
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:default=OAuth

OAuth/token status

google-antigravity
- google-antigravity:default ok expires in 0m
google-gemini-cli
- google-gemini-cli:default ok expires in 0m
openai-codex
- openai-codex:default ok expires in 10d

#

Auth probes
┌─────── │ Model ├─────── │ google/gemini-1. │ 5-flash │ │ google- │ antigravity/ │ claude-opus-4-5- │ (oauth) │ thinking │ │ │ │ │ │ google-gemini- │ cli/gemini-2.0- │ flash │ │ │ │ │ │ │ │ ollama/- │ │ │ openai-codex/ │ gpt-5.4 │ │ └─────── Probed 3 targets in 33s ───────────┬────────────────────────┬──────────────────────────────────┐
│ Profile │ Status │
───────────┼────────────────────────┼──────────────────────────────────┤
│ models.json (api_key) │ ok · 11.2s │
│ │
│ google- │ auth · 5.6s │
│ antigravity:default │ ↳ OAuth token refresh failed │
│ for google-antigravity: Failed │
│ to refresh OAuth token for │
│ google-antigravity. Please try │
│ again or re-authenticate. │
│ google-gemini- │ auth · 1.3s │
│ cli:default (oauth) │ ↳ OAuth token refresh failed │
│ for google-gemini-cli: Failed │
│ to refresh OAuth token for │
│ google-gemini-cli. Please try │
│ again or re-authenticate. │
│ env (api_key) │ no_model · - │
│ ↳ No model available for probe │
│ openai-codex:default │ unknown · - │
│ (oauth) │ ↳ Excluded by auth.order for │
│ this provider. │
───────────┴────────────────────────┴──────────────────────────────────┘

hollow moatBOT Apr 13, 2026, 9:41 AM

#

That paste still cuts off before the auth/probe part, so we still can’t see the actual resolved profile order.

What we do know now:

2026.4.11
no per-agent override
so main should be using openclaw.json auth.order.openai-codex

At this point the two likely causes are:

the IDs in auth.order.openai-codex no longer exactly match the current openai-codex:* profile IDs
2026.4.11 has a regression here

Can you run this more targeted one and paste it?

#

openclaw models status --json --probe --probe-provider openai-codex

I’m specifically looking for whether it shows:

the current openai-codex profile IDs
excluded_by_auth_order
unusableProfiles

If you want the fastest local sanity check, also compare:

auth.order.openai-codex in ~/.openclaw/openclaw.json
the actual openai-codex:* keys in ~/.openclaw/agents/main/agent/auth-profiles.json

If those strings differ at all, the default order can effectively stop matching.

#

Let me check the Codex auth code path quickly, because your output shows the real problem now: OpenClaw only sees one Codex profile, not five.

#

Ah, okay, this makes it pretty clear.

The problem is not the order file anymore. The problem is that OpenClaw currently sees only one Codex auth profile:

openai-codex:default
profiles=1

So there’s nothing left to rotate between. Your old 5-profile auth.order.openai-codex can’t apply if only one openai-codex:* profile exists in auth-profiles.json.

I checked the current source, and the Codex external CLI sync path is wired to a single fixed profile id, openai-codex:default. So if your old setup depended on multiple Codex logins in one agent, this really does look like a regression in 2026.4.11.

Short version:

auth-profiles.json no longer contains your 5 Codex profiles
OpenClaw only detects 1 Codex profile now
so the configured order is effectively dead data

#

I’d file this as a bug, with exactly this evidence:

openclaw --version
openclaw models auth order get --provider openai-codex
openclaw models status --probe
mention that multi-profile Codex auth collapsed to a single openai-codex:default

Bug tracker:
https://github.com/openclaw/openclaw/issues

Relevant docs:

Workaround for now, if you need multiple Codex accounts immediately:

use separate agents, one Codex login per agent, or
re-add the accounts if you have a path that restores multiple openai-codex:* profiles

#

Glad we caught the real failure mode, it’s not just the order key moving.

#

Yep, that probe nails it.

openai-codex:default is being excluded by your global auth.order.

So the situation is:

openclaw.json still has the old 5-profile auth.order.openai-codex
auth-profiles.json now only has one Codex profile: openai-codex:default
because explicit auth.order exists, OpenClaw will exclude any stored profile not listed there
result: your only live Codex profile gets skipped

Fix right now, global/default

In ~/.openclaw/openclaw.json, either:

remove auth.order.openai-codex entirely, or
replace it with:

#

auth: {
  order: {
    "openai-codex": ["openai-codex:default"]
  }
}

Then restart:

openclaw gateway restart

What this means

This fixes the immediate breakage, but it also confirms the deeper regression:

#

your old multi-profile Codex setup collapsed to a single openai-codex:default

So I’d still file a bug for that part, with this exact probe output:
https://github.com/openclaw/openclaw/issues

If you want, I can help you write the issue text cleanly.

sinful elk Apr 13, 2026, 9:43 AM

#

raise the bug

hollow moatBOT Apr 13, 2026, 9:44 AM

#

I can’t open the GitHub issue for you from here, but here’s a clean copy-paste draft.

File it at:
https://github.com/openclaw/openclaw/issues

Title

Codex multi-profile auth collapsed to openai-codex:default on 2026.4.11, causing auth.order to exclude the only remaining profile

Body

## Version

OpenClaw 2026.4.11 (769908e)

#

## Summary

After updating, my existing multi-profile OpenAI Codex auth setup appears to have collapsed to a single profile (`openai-codex:default`).

I previously had 5 Codex profiles and a matching global `auth.order.openai-codex` in `openclaw.json`.

After the update:

- `auth-profiles.json` only shows 1 Codex profile
- `openclaw models auth order get --provider openai-codex` shows no per-agent override
- `openclaw models status --probe` shows the only remaining Codex profile being excluded by `auth.order`

This breaks Codex auth entirely unless I manually remove or rewrite the old global order.

## Expected

#


One of these should happen:

1. existing multi-profile Codex auth profiles should be preserved, or
2. if profiles collapse/migrate, `auth.order` should be migrated too, or
3. the only remaining valid Codex profile should not be silently excluded

## Actual

The only remaining Codex profile is:

- `openai-codex:default`

And probe shows:

#

- `openai-codex/gpt-5.4`
- `openai-codex:default (oauth)`
- `Excluded by auth.order for this provider`

## Relevant outputs

### auth order
```text
openclaw models auth order get --provider openai-codex

Agent: main
Provider: openai-codex
Auth state file: ~/.openclaw/agents/main/agent/auth-state.json
Order override: (none)

#


### auth overview
```text
Auth overview
Auth store : ~/.openclaw/agents/main/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (3): google-antigravity (1), google-gemini-cli (1), openai-codex (1)
- openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:default=OAuth

OAuth/token status
- openai-codex
  - openai-codex:default ok expires in 10d

probe

#

Auth probes
...
│ openai-codex/ │ openai-codex:default │ unknown · - │
│ gpt-5.4 │ (oauth) │ ↳ Excluded by auth.order for │
│ │ │ this provider. │
...


## Workaround

Global workaround is to remove `auth.order.openai-codex` from `openclaw.json`, or replace it with:

```json5
auth: {
  order: {
    "openai-codex": ["openai-codex:default"]
  }

#

}


That restores functionality, but the old multi-profile Codex setup is still gone.

If you want, I can tighten that down even more before you post it.

sinful elk Apr 13, 2026, 9:56 AM

#

ok raised the bug is there any fix for now?

hollow moatBOT Apr 13, 2026, 9:56 AM

#

Yep, there’s a workable temporary fix.

Fastest fix now

In ~/.openclaw/openclaw.json, either:

remove auth.order.openai-codex completely, or
replace it with:

auth: {
  order: {
    "openai-codex": ["openai-codex:default"]
  }
}

Then restart:

#

openclaw gateway restart

That should restore Codex auth with the one remaining profile.

Important limitation

This only fixes access with the current surviving profile. It does not restore your old 5-profile rotation.

If you need multiple Codex accounts right now

Best workaround for now is:

one agent per Codex account

because your current install is only surfacing a single openai-codex:default profile in main.

If you want, I can help you sanity-check the exact openclaw.json edit before you restart.

sinful elk Apr 13, 2026, 9:59 AM

#

so relogging into my profiles is adding them to auth-profile so i suspect i need order in auth-state

hollow moatBOT Apr 13, 2026, 10:00 AM

#

Yep, that sounds right.

If re-login is recreating the openai-codex:* entries in auth-profiles.json, then the remaining problem is probably just that your global auth.order.openai-codex still points at the old profile IDs.

So:

No, you do not need auth-state.json for the default/shared fix.
Yes, auth-state.json would work as a temporary per-agent override for main.

Best fix if you want default/shared behavior

Update ~/.openclaw/openclaw.json so auth.order.openai-codex contains the current relogged profile IDs, in the order you want.

Then restart:

openclaw gateway restart

#

Easiest temporary fix

If you just want it working and don’t care about exact order for a minute, remove auth.order.openai-codex entirely from openclaw.json.

Then OpenClaw should use the stored profiles from auth-profiles.json and stop excluding them.

Only if you want a quick per-agent patch

You can use auth-state via:

openclaw models auth order set --provider openai-codex <profile1> <profile2> ...

But that is only for that agent, not your global default.

So your instinct is close, but for the setup you want, the real fix is: refresh openclaw.json with the new profile IDs.

sinful elk Apr 13, 2026, 10:01 AM

#

current state file:
{
"version": 1,
"lastGood": {
"openai-codex": "openai-codex:xxx@xx.tv"
},
"usageStats": {
"openai-codex:xx@xx.tv": {
"errorCount": 1,
"lastFailureAt": 1776074276268,
"lastUsed": 1776074016968,
"failureCounts": {
"rate_limit": 1
},
"cooldownUntil": 1776075560268,
"cooldownReason": "rate_limit",
"cooldownModel": "gpt-5.4"
}
}
}

hollow moatBOT Apr 13, 2026, 10:01 AM

#

Yep, that auth-state.json looks normal.

It’s only holding:

lastGood
usageStats
a temporary rate-limit cooldown for one Codex profile

There’s no problem with that file by itself, and you do not need to manually add order there unless you want a per-agent override.

Two useful takeaways from what you pasted:

your relogged Codex profile IDs are now being seen again
one of them is currently in a rate_limit cooldown for gpt-5.4, so it may get pushed back temporarily even with correct ordering

So the real fix is still:

update openclaw.json auth.order.openai-codex to the current relogged profile IDs, or

#

remove auth.order.openai-codex entirely and let OpenClaw use the stored profiles automatically

If you want a quick proof before editing global config

Use the CLI once to set a per-agent order for main:

openclaw models auth order set --provider openai-codex <current-profile-1> <current-profile-2> ...

If that works, then you know the global fix is just mirroring that same list into openclaw.json.

So, short answer: no, you don’t need to hand-edit auth-state.json for the default fix. The stale global auth.order is still the real thing to update.

sinful elk Apr 13, 2026, 10:01 AM

#

openclaw.json is fine its the order statement in auth-state that i need updating

hollow moatBOT Apr 13, 2026, 10:02 AM

#

If your goal is to fix main right now, then yes, auth-state is the lever.

auth-state.json order override takes precedence over openclaw.json, so the clean way is:

openclaw models auth order set --provider openai-codex <current-profile-1> <current-profile-2> <current-profile-3> ...

That writes the order block into auth-state.json for main.

Then verify with:

openclaw models auth order get --provider openai-codex
openclaw models status --probe

#

A couple of gotchas:

use the current relogged openai-codex:* IDs from auth-profiles.json
don’t hand-edit auth-state.json if you can avoid it, the CLI is safer
a profile in rate_limit cooldown can still get pushed to the back temporarily

If you want to go back to config-only later:

openclaw models auth order clear --provider openai-codex

So yes, for the immediate fix you’re describing, auth-state order override is the right move.

dire sandal Apr 14, 2026, 3:51 AM

#

@hollow moat why is the new 4.12 update making google gemini cli not work properly

hollow moatBOT Apr 14, 2026, 3:52 AM

#

That sounds like a separate issue from the Codex order bug, so please open a new #help thread for it so this one stays searchable 👍

In the new thread, please include:

openclaw --version
openclaw models status

and the exact Gemini CLI error/output you’re seeing.

Relevant setup docs:
https://docs.openclaw.ai/help/faq#how-do-i-set-up-gemini-cli-oauth

If you paste the error there, I can help dig in.

sinful elk Apr 16, 2026, 8:35 AM

#

what can i add to the auth-state .json to include the order?

hollow moatBOT Apr 16, 2026, 8:35 AM

#

You’d add a top-level order block, like this:

{
  "version": 1,
  "order": {
    "openai-codex": [
      "openai-codex:profile1@example.com",
      "openai-codex:profile2@example.com",
      "openai-codex:profile3@example.com"
    ]
  },
  "lastGood": {
    "openai-codex": "openai-codex:profile2@example.com"
  },
  "usageStats": {

#

    "openai-codex:profile2@example.com": {
      "errorCount": 1,
      "lastFailureAt": 1776074276268,
      "lastUsed": 1776074016968,
      "failureCounts": {
        "rate_limit": 1
      },
      "cooldownUntil": 1776075560268,
      "cooldownReason": "rate_limit",
      "cooldownModel": "gpt-5.4"
    }
  }
}

A couple of important bits:

#

use the current openai-codex:* profile IDs from auth-profiles.json
keep lastGood and usageStats as-is
order is a top-level sibling of those fields

That said, I’d still strongly recommend writing it with the CLI instead of hand-editing:

openclaw models auth order set --provider openai-codex <profile1> <profile2> <profile3>

Then verify:

openclaw models auth order get --provider openai-codex
openclaw models status --probe

#Profile Order OpenAI Codex Broken

Fix right now, global/default

What this means

probe

Fastest fix now

Important limitation

If you need multiple Codex accounts right now

Best fix if you want default/shared behavior

Easiest temporary fix

Only if you want a quick per-agent patch

So the real fix is still:

If you want a quick proof before editing global config