unexpected status 401 Unauthorized - Codex

Quick fix

Edit the Codex config.toml by hand to add the model_provider declaration and the matching provider section, or upgrade cc-switch to the latest version.

Symptom

Error outputCopy

unexpected status 401 Unauthorized: Incorrect API key provided: sk-9979a***********************225a. You can find your API key at https://platform.openai.com/account/api-keys., url: https://api.openai.com/v1/responses, cf-ray: a06fd811bfa649f7-TPE, request id: req_5cf0db278fa644f59381a0424fd76c15, auth error: 401, auth error code: invalid_api_key

Cause

The config.toml cc-switch writes uses a flat format, missing the top-level model_provider declaration and the [model_providers.xxx] section. The Codex CLI therefore ignores the custom base_url, defaults to the built-in openai provider, and sends requests straight to api.openai.com. Since you are using a DeepSeek or other third-party relay API Key, OpenAI rejects the request with a 401 (in some regions network restrictions may return 403 Forbidden instead).

Maintainers fixed the local routing takeover between v3.16.2 and v3.16.4, but per user reports the missing configuration format still occurs in the local proxy takeover mode of v3.19.1.

Fix

1. 1

   Try upgrading cc-switch to v3.16.4 or newer, reconfigure the DeepSeek provider, and turn local routing on.

2. 2

   If the problem persists after upgrading, edit the Codex config file by hand and change the flat format into the custom provider format Codex requires.

3. 3

   Add the model_provider declaration and the matching [model_providers.ccswitch] section to the config file:

   ~/.codex/config.toml

   model_provider = "ccswitch"
   model = "astron-code-latest"
   wire_api = "responses"
   model_catalog_json = 'C:\Users\LENOVO\.codex\cc-switch-model-catalog.json'
   
   [model_providers.ccswitch]
   name = "CC Switch"
   base_url = "http://127.0.0.1:15721/v1"
   wire_api = "responses"

4. 4

   Or override the configuration temporarily with command-line arguments at startup: codex -c model_provider=ccswitch -c model_providers.ccswitch.base_url=http://127.0.0.1:15721/v1 -c model_providers.ccswitch.wire_api=responses

Affected Versions

ToolCodex

Versioncc-switch 3.16.0 - 3.19.1

PlatformsWindowsmacOS

Source Issues

This page is distilled from 2 real issues

• #3449CC-Switch 写入的 `config.toml` 格式不被 Codex CLI 识别，导致自定义路由配置始终不生效
• #3778codex desktop 使用 DeepSeek 官方 api 无法连接

FAQ

What if /model still does not show the DeepSeek model after editing the configuration?

The local Codex cache may have no metadata for that custom model alias (astron-code-latest, for instance). This is not fatal — Codex still falls back to generic mode and works. If it says models_cache.json cannot be found, start Codex once normally to generate the cache file, then switch routing with cc-switch.

Why is my error 403 Forbidden rather than 401?

Connecting directly to api.openai.com, a network environment under OpenAI regional restrictions (mainland China or a Hong Kong exit, for instance) returns 403 after the WebSocket reconnection fails and falls back to HTTPS. The root cause is the same: a malformed config.toml means the request never goes through the local proxy.

Related problems

General config has no effect and gets overwritten by earlier config - Codex CC SwitchUpgrade to CC Switch v3.17.0+ to fix Codex general-config merging. If an old snapshot still overwrites it, switch to another provider and back to self-heal.21 issues merged404 Not FoundDeepSeek does not support the Responses API — use the built-in preset to route through Chat Completions. For image errors, drop the image modality.5 issues mergedCC Switch local proxy failed while handlingUpgrade CC Switch to the latest version and start a new Codex conversation; invalid schema or image blocks left in old session history will keep triggering 400.43 issues merged