Codex: 401 Unauthorized, Missing Bearer or Basic Authentication in Header
'unexpected status 401 Unauthorized: Missing bearer or basic authentication in header, url: https://api.openai.com/v1/responses' means the request reached OpenAI with no credentials attached at all. It is different from 'Incorrect API key provided', where a key was sent but was wrong. With Codex, the missing header usually comes from one of four places: a login cache that is stale or was cleared, a mix of sign-in methods (an OPENAI_API_KEY or CODEX_API_KEY in the environment alongside ChatGPT sign-in), a custom base URL or proxy in config.toml that changes where credentials go, or a bug in a specific Codex release. Codex GitHub issues show all of these, including a release where auth headers were not sent in ChatGPT login mode and a case where a fallback from WebSocket to HTTPS dropped the credentials. Signing out and back in fixes most cases; if it does not, check configuration and version.
Learn AI properly, free or with a certificate
LearnWithZavi is our own site. The Udemy link is an affiliate link; we may earn a commission at no extra cost to you.
Symptoms You Might See
Codex fails immediately with 401 Unauthorized after you sign in
The error names https://api.openai.com/v1/responses
codex login status says you are logged in, but requests still fail
It started right after updating Codex
It happens only when a proxy or custom provider is configured
Common Causes
Stale or broken login cache
Codex caches credentials in ~/.codex/auth.json or the OS credential store. If that cache is corrupted, expired or from a different workspace, requests can go out without a valid token.
Mixed sign-in methods
Having OPENAI_API_KEY or CODEX_API_KEY set while you also sign in with ChatGPT can confuse which credentials apply, and one Codex release sent no Authorization header at all when CODEX_API_KEY was set.
Custom base URL or proxy configuration
If config.toml points to a local proxy or custom provider but the key is sent to the default endpoint, or the reverse, OpenAI sees a request without the expected bearer token.
A Codex version bug
GitHub issue #39883 documents a release where auth headers were not sent in ChatGPT login mode, fixed by updating or rolling back. Another report shows the HTTPS fallback path dropping credentials.
Step-by-Step Fixes
Sign out and sign in again
When to try: First
Run codex logout, then codex login and complete the browser sign-in. In the app or IDE extension, use Log out from the profile menu, then sign back in.
Check which method is active
When to try: When environment keys are set
Run codex login status. If you mean to use your ChatGPT plan, unset OPENAI_API_KEY and CODEX_API_KEY in your shell profile and terminal before signing in again.
Sign in with an API key correctly
When to try: When you use API billing
If you want API billing, pipe the key in rather than relying on environment variables: printenv OPENAI_API_KEY | codex login --with-api-key.
Review config.toml for providers and base URLs
When to try: When you use a proxy or custom provider
Open ~/.codex/config.toml and check any model_provider, base_url or openai_base_url settings. Remove them to test the default path, or make sure a proxy provider sets requires_openai_auth or the right env_key.
Update Codex, or roll back one version
When to try: When it started right after an update
Update to the latest CLI and extension. If the error started with a specific new release, check github.com/openai/codex issues for that version and temporarily install the previous one.
Clear the cached credentials file
When to try: When login status looks wrong or stuck
If logging out and in does not help, close Codex, move ~/.codex/auth.json to a backup location, then run codex login again. Treat that file like a password and never share it.
How to Prevent This
Use one sign-in method per machine
Keep API keys out of your global shell profile if you use ChatGPT sign-in
Note your Codex version before updating so you can roll back
Document any custom provider settings in config.toml
When to Contact Support
Report it on github.com/openai/codex if a clean logout and login on the latest version still returns 401 with no custom providers configured, or if it happens across several machines on the same account. Include the Codex version, the cf-ray and request ID from the error, and the feedback ID from /feedback.
Frequently Asked Questions
What does 'Missing bearer or basic authentication in header' mean?▼
The request reached OpenAI without any Authorization header, so OpenAI could not tell who you are. It points to a login, configuration or client problem rather than a wrong key.
Why do I get 401 right after signing in to Codex?▼
Usually because another credential source is overriding the login (an environment API key), a custom provider is changing the request, or a buggy release is not sending the header. Check login status, environment variables and your version.
Where does Codex store my login?▼
In ~/.codex/auth.json or your operating system's credential store, depending on the cli_auth_credentials_store setting.
Is this the same as 'Incorrect API key provided'?▼
No. That error means a key was sent but rejected. 'Missing bearer' means nothing was sent.
Does this mean my account is banned?▼
No. An account problem gives a different message. A missing header is a client-side or configuration issue.
Sources and verification
Product behavior and limits can change. These primary sources were used to verify this guide.
Other Common AI Errors
ChatGPT Not Working
Service Issues
🚦Rate Limit Exceeded
Usage Limits
📏Context Length Exceeded
Input Limits
🔥Model Overloaded
Service Issues