Skip to content
CC Switch WikiUnofficial Community Wiki

502 Bad Gateway Codex proxy takeover overwrites config.toml

Quick fix

Disable global proxy and switch to rule mode with direct connection to 127.0.0.1, or upgrade cc-switch to avoid fully overwriting config.toml.

Symptom

Section titled “Symptom”
Error output
■ unexpected status 502 Bad Gateway: , url: http://127.0.0.1:15721/v1/responses

Cause

Section titled “Cause”

This page covers two interrelated root causes that, in different scenarios, prevent Codex from working properly through the CC Switch local proxy.

**Root cause 1: System global proxy intercepts local loopback traffic.** When users enable the "Global Proxy" mode of proxy software such as Clash Verge / v2rayU, all traffic (including local requests sent to `127.0.0.1` and `localhost`) is forcibly routed to the proxy server. Since the CC Switch local proxy listens on `127.0.0.1:15721`, the global proxy prevents Codex from directly accessing this port, resulting in a `502 Bad Gateway`.

**Root cause 2: CC Switch proxy takeover fully overwrites config.toml.** When Codex local proxy takeover is enabled (`enableLocalProxy = true`), CC Switch uses the provider template saved in the database to perform a "full overwrite" rewrite of `~/.codex/config.toml` during startup, provider switching, or abnormal exit recovery, instead of an incremental merge. This causes user-added MCP server configurations, `[desktop]` UI preferences, `[memories]` memory settings, `[projects]` trust levels, `sandbox_mode`, and other non-provider-related personalized configuration sections to be completely discarded. Additionally, in the abnormal exit recovery path, CC Switch reads the pre-takeover full-file snapshot from the `proxy_live_backup` table and writes it back as-is, causing MCP servers deleted by the user during the takeover period to "revive".

Fix

Section titled “Fix”

  1. Check the proxy mode of your proxy software (such as Clash Verge / v2rayU) and change "Global Proxy" to "Rule Proxy".

    在 Clash Verge / v2rayU 规则配置中添加：
    # DOMAIN-SUFFIX,localhost,DIRECT
    # IP-CIDR,127.0.0.0/8,DIRECT

  2. Ensure that in the rule proxy, `127.0.0.1` and `localhost` use direct connection (DIRECT) and do not go through proxy nodes.

  3. If the issue causes MCP or personalized configurations to be lost due to a CC Switch restart, upgrade CC Switch to the latest version. Enable the "Preserve Codex Official Authentication" option in settings to prevent OAuth login status from being overwritten.

  4. If the issue persists after upgrading, as a temporary workaround, you can manually modify the `original_config` field in the `proxy_live_backup` table within the CC Switch database (`~/.cc-switch/cc-switch.db`) to append the missing TOML segments.

Affected Versions

Section titled “Affected Versions”
ToolCodex
Version3.16.0 - 3.19.2（受影响版本范围）
PlatformsWindowsmacOS

Source Issues

Section titled “Source Issues”

This page is distilled from 29 real issues

FAQ

Section titled “FAQ”
What should I do if I still get the error Reconnecting... 2/5 (8s • esc to interrupt) after disabling VPN?
This is usually caused by residual local network or proxy rules. Try replacing `127.0.0.1` with `localhost` in the configuration, and ensure the system proxy is completely disabled with no residual proxy rules intercepting local loopback traffic.
What should I do if all Codex plugins fail after restarting the computer and require reinstallation?
This is because CC Switch overwrote `~/.codex/auth.json` during startup, breaking the OAuth status. Please upgrade to the latest version (v3.16.4+) and enable the "Preserve Codex Official Authentication" option in settings.
What should I do if the model in config.toml is not updated after editing the provider's model field in place?
This is a known bug in v3.16.3, where the in-place update code path for providers missed the serialization of the `model` field. A temporary workaround is to create a new provider (or copy an existing one), set the new model, and enable it; the new flow will write the complete provider block.
What should I do if an MCP server comes back after restarting CC Switch even though I deleted it?
This is because the deletion operation only cleaned the `mcp_servers` table and the live configuration file, but the pre-takeover full-file snapshot in the `proxy_live_backup` table still contains that server. When CC Switch exits, the snapshot is written back to config.toml as-is, causing the server to revive. You need to clean the snapshot record in the database simultaneously.
What should I do if Codex directly connects to wss://api.openai.com bypassing the proxy after enabling local routing on macOS?
The `transport_kind` field of Codex defaults to `responses_websocket`, and WebSocket connections ignore `base_url` and directly connect to the official endpoint. You need to explicitly set `transport_kind = "responses_http"` in the config.toml generated by CC Switch.
Section titled “Related problems”
General config has no effect and gets overwritten by earlier config - Codex CC SwitchUpgrade to CC Switch v3.17.0+ to fix Codex general-config merging. If an old snapshot still overwrites it, switch to another provider and back to self-heal.21 issues mergedunsupported call: - CodexUpgrade cc-switch to v3.16.4+ to fix tool call name/id overwritten by empty deltas during streaming conversion.1 issues mergedcontent[].thinking must be passed backUpgrade cc-switch to v3.16.0 or newer. As a stopgap, roll Claude Code back to 2.1.150 or turn thinking off.11 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.