Skip to content
CC Switch WikiUnofficial Community Wiki

401 Unauthorized: Incorrect API key provided - CC Switch Codex DeepSeek

Quick fix

Codex via CC Switch to DeepSeek returns 401; manually add http_headers auth headers (Authorization: Bearer or x-api-key) in the config file.

Symptom

Section titled “Symptom”
Error output
unexpected status 401 Unauthorized: Incorrect API key provided: 123456. You can find your API key at https://platform.openai.com/account/api-keys., url: https://api.openai.com/v1/responses, cf-ray: a1ffe910ba36683c-NRT, request id: f56e5cc5-be53-4a44-aa57-efacc1869ac0

Cause

Section titled “Cause”

After configuring the DeepSeek provider in CC Switch and switching to Codex, requests from Codex still point to https://api.openai.com/v1/responses, but the request carries no valid auth header (API Key), so the OpenAI endpoint returns 401 Unauthorized. That is, CC Switch only wrote half of the config during switching, and the key auth fields were not fully written into the Codex config file (issue #4491 calls this "only half the config written"); multiple users in #5571 reproduced the same 401 error. The community-verified workaround is to manually add http_headers auth headers in the Codex config. Another user (#6068) reported that the model list also did not refresh when disabling routing to switch back to the official endpoint, indicating the switch/write-back logic of that version was broadly flawed. The maintainer stated in #6068 that starting from 4.0 only key fields are changed, and config is rewritten per the direct provider when routing is disabled.

Fix

Section titled “Fix”

  1. Open the Codex config file (the Codex TOML config file), manually add an auth header in the corresponding provider section, and replace sk-123 with your own DeepSeek API Key: http_headers = { "Authorization" = "Bearer sk-" }, or use http_headers = { "x-api-key" = "sk-123" } as the provider requires. Two users confirmed recovery with each of these two forms respectively.

  2. If manually adding headers still fails, try fully uninstalling and reinstalling Codex, clearing all Codex configuration, and reconnecting (a user in issue #5571 resolved the "only shows login screen" connection failure this way).

  3. Use the built-in DeepSeek Codex template in CC Switch to create the provider config instead of building it fully yourself (the solution suggested in issue #4491), reducing the chance of missing fields.

  4. Upgrade to CC Switch 4.0 or later: the maintainer explained in #6068 that starting from 4.0 switching only changes key fields, and when routing is disabled the config is rewritten per the direct provider, which improves the problem of incomplete config after switching. If it still reproduces after upgrading, report again with the version number and logs.

Affected Versions

Section titled “Affected Versions”
ToolCodex
Version在 CC Switch 3.16.3 - 3.17.0 上有报告；维护者称 4.0 起改进了配置写回逻辑
PlatformsWindowsmacOS

Source Issues

Section titled “Source Issues”

This page is distilled from 3 real issues

FAQ

Section titled “FAQ”
Local CC Switch config for DeepSeek passes speed tests, but Codex login via API Key shows 401. How to fix?
Manually add http_headers = { "x-api-key" = "sk-123" } or http_headers = { "Authorization" = "Bearer sk-" } in the Codex config file (replace sk- with your real Key); two users confirmed recovery with each of these forms.
I don't want to manually patch config every time. Is there an easier way?
Use the built-in DeepSeek Codex template config file in CC Switch instead of a self-built provider config (suggested in #4491 comments); the maintainer also recommends upgrading to 4.0 or later, where switching logic only writes key fields.
After configuring DeepSeek in Codex normally, it only shows a login screen when opened. What to do?
One user recovered by reinstalling Codex and clearing all Codex configuration (#5571 comment).
After disabling routing to switch back to OpenAI official, /model still shows DeepSeek models. What to do?
This is caused by stale model catalog left by the switching tool. The maintainer stated in #6068 that starting from 4.0.2 the model catalog pointer follows the current provider; when routing is disabled the config is rewritten per the direct provider and official login is restored automatically. Upgrade to the latest version and retry using only CC Switch.
Section titled “Related problems”
Codex unavailable: reconnect failed 5 timesAfter switching providers, verify and re-enter the current provider's API Key; API Key overwrite reports continued in v3.16.3.4 issues mergedProvider API Key Overwritten: After Codex Restart or SwitchUpgrade to cc-switch v4.0.0 or later to prevent provider keys from overwriting each other and restore the official login state.6 issues merged[DISCUSS] Support for pi coding agentThis is a feature request merged into tracking issue #1855; the original post provides no verifiable solution.1 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.