Skip to content

Codex CLI picks up OPENAI_API_KEY from project .env (via shell auto-loading), causing 401 “AK/SK” errors and confusing /status #2341

Closed
Closed
Codex CLI picks up OPENAI_API_KEY from project .env (via shell auto-loading), causing 401 “AK/SK” errors and confusing /status#2341
Labels
bugSomething isn't working

Description

@ac1982
ac1982
opened on Aug 15, 2025

What version of Codex is running?

0.21.0

Which model were you using?

gpt-5

What platform is your computer?

Darwin 24.6.0 arm64 arm

What steps can reproduce the bug?

What steps can reproduce the bug?

  1. In any project folder, create a .env file containing:

    OPENAI_API_KEY=sk-<some-other-key>

    (Many shells/IDEs auto-load .env automatically — e.g., direnv, zsh-dotenv, VS Code terminal.)

  2. From that project directory, run:

    codex --login   # choose “Sign in with ChatGPT”
codex

  3. Ask Codex to perform any action (e.g., pls run npm lint, and if problems, try to fix them.).

What is the expected behavior?

What is the expected behavior?

  • When signed in via ChatGPT, Codex should use the token generated by that login, not silently override it with OPENAI_API_KEY from the local environment.
  • /status should display which credential is actually being used (ChatGPT token or environment key) and clearly indicate when an override is happening.

What do you see instead?

Additional information

  • Actual result: 401 Unauthorized errors such as:

    AuthenticationError: the API key or AK/SK in the request is missing or invalid

    even though /status still shows:

    Provider: OpenAI  
Model: gpt-5  
Signed in with ChatGPT (Plan: Plus)

  • Removing or renaming OPENAI_API_KEY in .env immediately resolves the problem.

  • Workarounds:

    env -u OPENAI_API_KEY codex

    or rename the variable to something like APP_OPENAI_API_KEY.

  • Suggestions:

    • Add /status transparency for credential source.
    • Warn when environment variables override ChatGPT sign-in.
    • Provide a --ignore-env flag.

Additional information

No response

Activity

  1. ac1982
    added
    bugSomething isn't working
    on Aug 15, 2025

  2. seratch commented on Aug 18, 2025

    @seratch
    seratch
    on Aug 18, 2025
    Member

    I tried to see the error you're encountering, but it looks like codex itself doesn’t fail under these conditions. Could it be that some of your command executions, which rely on the OPENAI_API_KEY environment variable, are failing instead? If that’s the case, I understand how frustrating it must be, but I’m not sure it would be right to modify the environment variables on the codex side.

  3. hourianto commented on Aug 21, 2025

    @hourianto
    hourianto
    on Aug 21, 2025

    I also have the same issue, if there's an .env file present in the project folder where I launch Codex, it will first get OPENAI_API_KEY from that file, not from the environment variables in the shell, which is really inconvenient.

    For now I had to create a separate model provider with a different env_key, but I hope there will be an easier solution soon.

  4. ac1982 commented on Aug 22, 2025

    @ac1982
    ac1982
    on Aug 22, 2025
    Author

    #2342

  5. imajes commented on Aug 25, 2025

    @imajes
    imajes
    on Aug 25, 2025

    I don't entirely know if this is the reason, but it is related:

    in config.toml, i had a block like this, which i believe was historically correct:

    [model_providers.openai-responses-completions]
name = "OpenAI using Responses Completions"
base_url = "https://api.openai.com/v1"
env_key = "OPENAI_API_KEY"
wire_api = "responses"

    and then wired up the gpt5 profile as such:

    [profiles.gpt5]
model = "gpt-5"
approval_policy = "on-request"
model_reasoning_effort = "high"
model_reasoning_summary = "detailed"
model_provider = "openai-responses-completions"

    It turns out that that provider is not correct for using ChatGPT Plus/Pro credentials. By removing the model_provider= line from the profile, i stopped getting auth errors.

  6. dylan-hurd-oai
    marked 🖐 unexpected status 400 Bad Request #2459 as a duplicate of this issue on Sep 6, 2025

  7. etraut-openai commented on Nov 2, 2025

    @etraut-openai
    etraut-openai
    on Nov 2, 2025
    Contributor

    The CLI no longer implicitly logs in using the env variable. You now must explicitly log in using codex login --api-key or go through the TUI-based login flow.

  8. etraut-openai
    closed this as completedon Nov 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions