Skip to content
CC Switch WikiUnofficial Community Wiki

unexpected status 401 Unauthorized: Codex DeepSeek

Quick fix

Upgrade to CC Switch 4.0. On 3.x, declare a custom model_provider in config.toml so Codex does not ignore the proxy and connect directly to OpenAI.

Symptom

Section titled “Symptom”
Error output
unexpected status 401 Unauthorized: Incorrect API key provided: sk-9979a***********************225a. You can find your API key at https://platform.openai.com/account/api-keys., url: https://api.openai.com/v1/responses, cf-ray: a06fd811bfa649f7-TPE, request id: req_5cf0db278fa644f59381a0424fd76c15, auth error: 401, auth error code: invalid_api_key

Cause

Section titled “Cause”

The Codex configuration written by CC Switch 3.x may contain only top-level base_url and wire_api settings, without a top-level model_provider or a matching [model_providers.<id>] section. Codex therefore continues using the built-in openai provider, ignores the custom endpoint, and sends the DeepSeek API key to https://api.openai.com/v1/responses, where OpenAI rejects it with a 401. The same defect was reproduced both with local proxy routing and standard provider switching.

The maintainer previously advised users of 3.16.1 to upgrade to 3.16.4 because versions 3.16.2 through 3.16.4 fixed several local routing issues. However, users later reproduced the missing model_provider configuration issue in 3.19.1 and 3.20.2. According to the latest maintainer response, Codex configuration writing was redesigned in 4.0, largely resolving the TOML writing and missing-model issues in 3.x. The original report considered requires_openai_auth and experimental_bearer_token necessary, but later testing with Codex CLI 0.146.0 showed that neither is required for local proxy routing.

Fix

Section titled “Fix”

  1. Prefer upgrading to the latest CC Switch 4.0. Reconfigure the DeepSeek provider, enable local routing, and confirm that requests are no longer sent to api.openai.com.

  2. If you must remain on 3.x, edit the Codex configuration to explicitly set model_provider for the local proxy and create a provider section with the same name.

    C:\Users\LENOVO\.codex\config.toml
    model_provider = "ccswitch"
    

    [model_providers.ccswitch]
    name = "CC Switch"
    base_url = "http://127.0.0.1:15721/v1"
    wire_api = "responses"

  3. Run codex doctor or inspect the codex exec startup banner to confirm that the provider is no longer openai. Also check whether Codex requests appear in the CC Switch proxy request log.

  4. If the issue still occurs on 4.0, provide the project with the current CC Switch version, reproduction steps, logs, and the actual base_url value written to config.toml.

Affected Versions

Section titled “Affected Versions”
ToolCodex
Version3.16.0 - 3.20.2（受影响）；4.0（维护者称已重做修复）
PlatformsWindowsmacOS

Source Issues

Section titled “Source Issues”

This page is distilled from 2 real issues

FAQ

Section titled “FAQ”
After changing the configuration, I see a model metadata warning and /model still does not show DeepSeek. Does this mean the configuration failed?
A comment explains that when a custom model alias is absent from the Codex local cache, it falls back to generic mode. The warning is not necessarily fatal. Verify the actual provider and request endpoint instead of relying only on the /model list.
What should I do if switching routes reports Codex model catalog template `gpt-5.5` not found?
One user reported that preparing models_cache.json before switching with the custom provider configuration resolved the issue. The error also suggests starting Codex once to generate models_cache.json or ensuring that the codex CLI is in PATH.
Must requires_openai_auth = false and experimental_bearer_token be set?
The original report listed requires_openai_auth = false as required. However, later testing with Codex CLI 0.146.0 showed that local proxy routing works with only a correct model_provider and matching [model_providers.<id>] section, without experimental_bearer_token. The conclusions differ by version.
Section titled “Related problems”
Invalid schema for function — CodexUpgrade CC Switch to a version including the v3.18.0 fix for `parameters.type:null`; track the original issues for other `null` schema variants.13 issues mergedProvider API Key Overwritten: After Codex Restart or SwitchUpgrade to cc-switch v4.0.0 or later to prevent provider keys from overwriting each other and restore the official login state.6 issues mergedSwitching Codex providers overwrites config.tomlUpgrade cc-switch to v3.17.0+ and sync the MCP and other settings you want to keep into “General Configuration”; if an old snapshot still writes them back…21 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.