Skip to content
CC Switch WikiUnofficial Community Wiki

Codex provider API keys overwrite each other after a restart or switch - CC Switch

Quick fix

Enable CC Switch local proxy takeover, or use experimental_bearer_token in config.toml, to bypass the auth.json sync defect.

Symptom

Section titled “Symptom”
Error output
供应商 A 和 B 的 API Key 在重启/切换后互相覆盖。
English translation

The API keys of providers A and B overwrite each other after a restart or a switch.

Cause

Section titled “Cause”

CC Switch has a two-way sync defect in how it maintains API keys between its database and the Codex live config file (~/.codex/auth.json). Because auth.json is a global singleton, switching provider, restarting the app, or creating a config makes the CC Switch backfill/autosync logic read a stale value or an official login state out of auth.json and write it back over the correct config for the current provider in the database. On top of that, the direct file-write path fails in some versions, so what the UI shows and the key actually in effect disagree. The defect produces several variants: a third-party key overwritten by an official OAuth login state, a newly created empty provider polluted by old live data, a leftover third-party key breaking OAuth after switching to an official provider, and the UI edit page showing values from long ago. The cluster also contains an unrelated translator bug: under wire_api=responses, a streaming tool_call's call_id is overwritten by a later empty delta, leaving the tool call hung.

Fix

Section titled “Fix”

  1. Enable local proxy takeover (recommended). Turn the routing switch on in the CC Switch UI so requests go through the local proxy (127.0.0.1:15721, for example). That mode uses a separate in-memory config path and avoids the overwrite bug triggered by reading and writing auth.json directly.

  2. Bypass with experimental_bearer_token. If you must use direct file-write mode, hard-code the token for the custom provider in the Codex config and turn requires_openai_auth off, bypassing the auth.json global singleton.

    ~/.codex/config.toml
    [model_providers.custom]
    requires_openai_auth = false
    experimental_bearer_token = "YOUR_API_KEY"

  3. Clean up and rebuild by hand. If the official OAuth login state is already lost, delete the OPENAI_API_KEY field from ~/.codex/auth.json by hand and run codex login in a terminal to restore the official login. When switching provider, always disable routing first.

Affected Versions

Section titled “Affected Versions”
ToolCodex
VersionUnknown
PlatformsWindowsmacOS

Source Issues

Section titled “Source Issues”

This page is distilled from 7 real issues

FAQ

Section titled “FAQ”
I saved the right API key in the UI — why does it revert to the old one after a restart?
Because CC Switch reads the global value from ~/.codex/auth.json at startup and syncs it back into the database. If auth.json was never updated correctly, the old value overwrites the new one you saved in the UI. Enable proxy takeover mode to bypass this file sync logic.
After switching to an official provider, Codex shows "OpenAI" in the bottom right and my ChatGPT account will not work. What now?
A third-party OPENAI_API_KEY is left in auth.json, so Codex prefers API key auth and ignores the OAuth token. Clear the OPENAI_API_KEY field in auth.json by hand and run codex login again.
Codex hangs after a tool call with a third-party model and reports unsupported call. What is that?
A separate streaming translator bug. Under wire_api=responses, the CC Switch accumulation logic lets a later empty delta overwrite the call_id from the first chunk. There is no configuration workaround — use an official direct connection, or wait for the upstream fix.
Section titled “Related problems”
api failed deserialize json body intoDepending on the error: roll Claude Code back, upgrade cc-switch, turn the local proxy off, or stop sending unsupported fields.7 issues mergedCC Switch local proxy failed while handlingUpgrade CC Switch to the latest version and start a new Codex conversation; invalid schema or image blocks left in old session history will keep triggering 400.43 issues mergedGeneral config has no effect and gets overwritten by earlier config - Codex CC SwitchUpgrade to CC Switch v3.17.0+ to fix Codex general-config merging. If an old snapshot still overwrites it, switch to another provider and back to self-heal.21 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.