Skip to content
CC Switch WikiUnofficial Community Wiki

auth.json contamination in Codex

Quick fix

In Codex 3.16.0, the official login state remains in auth.json. Check provider, endpoint, and token for BYOK in config.toml.

Symptom

Section titled “Symptom”
Error output
后续所有的auth.json文件被污染，都不是apiKey的方式。
English translation

All subsequent auth.json files are contaminated and are no longer stored using the apiKey method.

Cause

Section titled “Cause”

The report states that after switching from OpenAI Official and reconnecting, later auth.json files were no longer stored using apiKey, and edits to auth.json in cc-switch were still overridden by the official configuration. Another commenter explained that this is a new mechanism in 3.16.0: auth.json only stores the official account login state, while provider, endpoint, and BYOK token are in config.toml. Therefore, "OPENAI_API_KEY": null in auth.json was described as normal.

Another user reproduced the same behavior: after switching to OpenAI Official, .codex/auth.json remained in account mode and did not change after switching to other configurations. The original post contains no maintainer-confirmed fix or WSL support solution; checking config.toml was the troubleshooting approach suggested in comments.

Fix

Section titled “Fix”

  1. After switching back to the BYOK configuration, check whether model_provider and experimental_bearer_token in config.toml have changed. The discussion states that these fields hold the provider, endpoint, and BYOK token.

  2. Do not treat "OPENAI_API_KEY": null in auth.json alone as evidence that the API Key configuration has failed. The discussion states that this value is normal under the official account login state.

  3. To check whether there is a later conclusion, follow the source issue. The original post does not yet provide a verifiable fix or WSL support solution.

Affected Versions

Section titled “Affected Versions”
ToolCodex
Version3.16.0（受影响报告版本）
PlatformsWindows

Source Issues

Section titled “Source Issues”

This page is distilled from 1 real issues

FAQ

Section titled “FAQ”
Why does .codex/auth.json not change after switching to OpenAI Official and then to another configuration?
The discussion explains that 3.16.0 keeps the official account login state in auth.json, while provider, endpoint, and BYOK token are in config.toml. Therefore, auth.json may remain in account mode.
Why is auth.json still overridden by the OpenAI Official configuration even after modifying it in ccswitch?
A user reported this behavior in the same issue. Comments suggest checking model_provider and experimental_bearer_token in config.toml after switching back to BYOK; the original post provides no verified fix.
Section titled “Related problems”
Provider API Key Overwritten: After Codex Restart or SwitchUpgrade to cc-switch v4.0.0 or later to prevent provider keys from overwriting each other and restore the official login state.6 issues mergedINVALID_API_KEY after switching providers in CodexUpgrade to v3.20.1 or later; third-party switching no longer writes to `auth.json`, preventing provider key/authentication mismatches.5 issues merged<thinking> tags output as body text in Claude CodeChanging the provider's apiFormat from openai_chat to anthropic, if supported upstream, can bypass inline <thinking> leakage.1 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.