⚠️ Model login expired on the gateway for openai-codex

[stuck vessel]

The error "⚠️ Model login expired on the gateway for openai-codex. Re-auth with openclaw models auth login --provider openai-codex, then try again." appears. After following the prompt to execute the "openclaw models auth login --provider openai-codex" command and restarting the Gateway, the same error message still occurs when sending a message.
OpenClaw Version: 2026.5.12

[orchid dune]

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

[quiet frost]

For 2026.5.12, that re-auth command should refresh the OpenAI Codex OAuth profile, so if the gateway still says expired I’d check whether it is using a different/old profile.

Please run these on the gateway host:

openclaw models status --probe --probe-provider openai-codex
openclaw models auth order get --provider openai-codex

What to look for:

• If the probe shows expired / invalid_expires, run:

openclaw models auth login --provider openai-codex --set-default
openclaw gateway restart
openclaw models status --probe --probe-provider openai-codex

[quiet frost]

• If the probe shows excluded_by_auth_order, or auth order get shows an override pointing at an older profile, clear it:

openclaw models auth order clear --provider openai-codex
openclaw gateway restart

Docs for the relevant commands:
https://docs.openclaw.ai/cli/models
https://docs.openclaw.ai/concepts/oauth
https://docs.openclaw.ai/gateway/authentication

If it still repeats after that, please paste the redacted output of:

openclaw models status --probe --probe-provider openai-codex
openclaw status --all

[quiet frost]

Those outputs should show whether this is an auth-order problem, a stale profile/store problem, or the gateway not loading the profile you just refreshed.

[stuck vessel]

Auth probes
┌──────────────────────┬──────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────┐
│ Model                │ Profile                                                  │ Status                                                  │
├──────────────────────┼──────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────┤
│ openai-codex/gpt-5.4 │ openai-codex:default (oauth)                             │ unknown · -                                             │
│                      │                                                          │ ↳ Excluded by auth.order for this provider.             │
│ openai-codex/gpt-5.4 │ openai-codex:[e-mail] ([e-mail]) (oauth) │ ok · 9.6s                                               │
└──────────────────────┴──────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────┘

這是執行"openclaw models status --probe --probe-provider openai-codex"得到的回覆。

[quiet frost]

這個結果代表：openai-codex:[e-mail] 這個 profile 是正常的，openai-codex:default 被目前的 auth.order 排除，所以 CLI 端的 OpenAI Codex OAuth 本身看起來已經 OK。

現在比較像是「這個 Discord thread/session 還黏在舊的 openai-codex:default profile」。OpenClaw 會把 auth profile per-session pin 起來，所以重新登入後舊 session 可能還在用舊 profile。

請在這個 Discord thread 裡試：

/model openai-codex/gpt-5.4@openai-codex:[e-mail]

然後再發一則普通訊息測試。

如果你不想指定 profile，也可以清掉 session pin：

/model openai-codex/gpt-5.4

[quiet frost]

或開新 session：

/reset

再測一次。

如果還是同樣錯誤，請貼這個 thread 裡的：

/model status

它會顯示目前這個聊天 session 實際選到哪個 agent / auth profile。相關 docs：https://docs.openclaw.ai/gateway/authentication https://docs.openclaw.ai/concepts/model-failover

這個狀態看起來是好的：目前 openai provider 已經透過 Codex runtime 使用 openai-codex:[e-mail]，而且 token 還有 10d。

下一步我會改測目前列出來的 model ref，不要再用舊的 openai-codex/gpt-5.4：

/model openai/gpt-5.5

或：

/model openai/gpt-5.4-mini

然後發一則普通訊息測試。

如果它仍然報 Model login expired on the gateway for openai-codex，請再貼兩個東西：

/model status

以及 gateway host 上：

openclaw models auth order get --provider openai-codex
openclaw status --all

因為現在 auth 本身看起來 OK，剩下比較像是這個 thread/session 的舊 model/profile pin，或 gateway 正在跑的 agent/session 沒吃到目前這份 ~/.openclaw/agents/main/agent/auth-profiles.json。

[stuck vessel]

openclaw models auth order get --provider openai-codex
openclaw status --all

I've finished running everything; what should I do now?

[quiet frost]

Please paste the output from those two commands, especially:

• the Order override: line from openclaw models auth order get --provider openai-codex
• the model/auth section from openclaw status --all

openclaw status --all should redact tokens, but still skim it and remove anything private before posting.

In the meantime, also try one fresh test in this thread:

/model openai/gpt-5.5

then send a normal message like test.

If that works, the fix is done. If it still says login expired, the command outputs will tell us whether the gateway is using an old auth order, a different agent dir, or stale session state.

Good, that rules out the auth-order problem. The gateway’s per-agent order is correctly set to the working profile:

openai-codex:[e-mail]

Now this is most likely stale session state in this Discord thread. Do this in the thread:

/reset
/model openai/gpt-5.5@openai-codex:[e-mail]

Then send a normal test message.

If it still fails after that, please paste:

/model status

and the model/auth part of:

openclaw status --all

At this point the key question is whether the active Discord session is still pinned to an old model/profile, or whether the running gateway is reading a different agent/session state than the CLI command is showing.

[stuck vessel]

openclaw status --all did not find the model/auth section.
Executing "/model openai/gpt-5.5@openai-codex:[e-mail]" resulted in the error: "The authentication profile 'openai-codex:[e-mail]' is intended for openai-codex, not openai."

[quiet frost]

You’re right — I gave you the wrong provider prefix for the explicit profile pin. Sorry, that error is clear: openai/gpt-5.5 is provider openai, but your OAuth profile belongs to openai-codex.

Use the openai-codex model ref when pinning that profile:

/model openai-codex/gpt-5.5@openai-codex:[e-mail]

If that model id is not available on 2026.5.12, use the one your probe already checked:

/model openai-codex/gpt-5.4@openai-codex:[e-mail]

Then send a normal test message.

Also, instead of openclaw status --all, use this for the auth/model section: