401 Unauthorized: Incorrect API key provided (error after switching Codex in cc-switch)

Quick fix

Upgrade to cc-switch 4.0.x, or clear the stale third-party OPENAI_API_KEY from ~/.codex/auth.json manually, restart Codex, and sign in again with ChatGPT OAuth.

Symptom

Error outputCopy

401 Unauthorized: Incorrect API key provided: PROXY_MA*AGED.

Cause

This error has two trigger paths in this cluster. First (#1238): cc-switch was unexpectedly closed after enabling a proxy, so the request address was not repopulated correctly. Codex/Claude Code sent placeholder or ineffective credentials and returned 401 Incorrect API key provided: PROXY_MA*AGED. The maintainer recommended reopening cc-switch to restore the correct value, though some users reported that repeating this did not work. Second (#3566): in cc-switch 3.16.1, when a third-party provider's key (such as GLM) was written to OPENAI_API_KEY in ~/.codex/auth.json, switching back to the OpenAI Official preset did not clear it. Codex sent this third-party key to https://api.openai.com/v1/responses, mismatching the credential and endpoint and returning 401 Unauthorized: Incorrect API key provided. OpenAI Official should use ChatGPT OAuth with requires_openai_auth = true and does not need an API key. The maintainer confirmed that v4.0.0 rewrote Codex authentication writes (third-party keys are written only to config.toml; official login is temporarily saved and restored when switching) and fixed the issue.

Fix

1. 1

   Temporary workaround (provided by the #3566 reporter): after switching back to OpenAI Official, open ~/.codex/auth.json manually and clear the stale third-party OPENAI_API_KEY (or back up and delete the file), then restart Codex so it falls back to ChatGPT OAuth login.

   ~/.codex/auth.json

   {
     "auth_mode": "chatgpt",
     "OPENAI_API_KEY": null,
     "tokens": {
       "id_token": "xxx",
       "access_token": "xxx",
       "refresh_token": "xxx",
       "account_id": "xxx"
     }
   }

2. 2

   Permanent fix: upgrade cc-switch to 4.0.x. v4 rewrote Codex authentication writes: third-party provider keys are written only to [model_providers.custom] in config.toml (experimental_bearer_token), and are no longer written to ~/.codex/auth.json. When switching to a third-party provider, the official login is saved temporarily; when switching back to OpenAI Official, it is restored and stale third-party keys are cleared.

3. 3

   If the error occurs with a proxy (the error shows the placeholder key PROXY_MA*AGED): reopen cc-switch so the request address, which was not repopulated when it was unexpectedly closed, is restored. Note: a user in #1238 reported that repeating this process did not work; in that case, use step 1 to inspect the configuration file manually.

Affected Versions

ToolCodex（缺陷在 cc-switch 的配置写入/代理回填逻辑）

Version3.16.1 确认受影响；4.0.0 已修复

PlatformsWindows

Source Issues

This page is distilled from 2 real issues

• #1238s 401 Unauthorized: Incorrect API key provided: PROXY_MA*AGED.
• #3566切换到 OpenAI Official 时，auth.json 未清空上一个 provider 的 API Key

FAQ

What is this repopulated request address? I repeated the process, but it did not work.

The issue does not provide the specific address; the maintainer only said that reopening cc-switch should restore it. If reopening does not work, check whether ~/.codex/auth.json still contains a third-party provider's OPENAI_API_KEY, clear it manually, and restart Codex.

Can the Windows version of the Codex App also be affected?

Yes. A user confirmed that after enabling a custom Codex provider in cc-switch and switching back to OpenAI Official, auth.json still contained the custom provider's API key. On startup, the Windows Codex App continued using that key to make requests to the OpenAI API instead of using official login authentication.

What should I do if the issue still reproduces after upgrading to 4.0.x?

The maintainer said you can reply to the original issue with reproduction steps and a redacted auth.json structure so they can reopen the investigation.

Related problems

Gateway /v1/models returned an unexpected body: Claude CodeNo verified solution is available; the local proxy must return an Anthropic `data` model-list format to Claude Code.1 issues mergedThe 'glm-5.3' model is not supported - CodexUpgrade to the latest version and disable proxy takeover. In 4.0.5 aggregation mode, start a new chat if old chats still fail randomly.4 issues merged[DISCUSS] Support for pi coding agentThis is a feature request merged into tracking issue #1855; the original post provides no verifiable solution.1 issues merged