Make OpenAI auth login use ChatGPT by default by pashpashpash · Pull Request #80790 · openclaw/openclaw

pashpashpash · 2026-05-11T22:00:31Z

Until now, the most obvious command for OpenAI auth still pointed at the direct API-key path, while the ChatGPT/Codex account login leaked the old openai-codex provider name into the user-facing setup flow. That is backwards now that OpenAI models default to the Codex runtime.

This makes openclaw models auth login --provider openai start the ChatGPT/Codex account login by default. If someone wants to add a paid API-key profile, they can still do that explicitly with --method api-key.

The selection rule is provider-shaped rather than OpenAI-shaped: when a provider offers OAuth, bare login chooses OAuth; when a provider only has one auth method, that method still runs; when a provider exposes several non-OAuth methods, OpenClaw keeps asking which one to use. The old openai-codex provider spelling remains available for scripts and existing config.

I also made openclaw models auth list --provider openai show the friendly OpenAI view across both normal openai:* API-key profiles and internal openai-codex:* ChatGPT subscription profiles, so the new command does not immediately force users back into the old naming.

Real behavior proof

Behavior addressed: openclaw models auth login --provider openai should start the ChatGPT/Codex OAuth login by default, while --method api-key should still start the OpenAI API-key setup and --method device-code should still start the code-based ChatGPT/Codex login. A misspelled explicit method should fail instead of silently falling back to OAuth.

Real environment tested: Local macOS maintainer checkout of this PR branch through c758dd03066f8d401a4dd96f72a2cc4ad337489a, using the real pnpm openclaw CLI with isolated temporary OPENCLAW_HOME directories under /tmp. The OAuth command opened the real OpenAI auth page in the browser; the flows were cancelled before completing auth, so no credentials were written to the normal local OpenClaw home.

Exact steps or command run after this patch:

OPENCLAW_HOME=/tmp/openclaw-proof-openai-login-4eTqAz pnpm openclaw models auth login --provider openai
OPENCLAW_HOME=/tmp/openclaw-proof-openai-api-key-MJEzVn pnpm openclaw models auth login --provider openai --method api-key
OPENCLAW_HOME=/tmp/openclaw-proof-openai-device-dwLu9l pnpm openclaw models auth login --provider openai --method device-code
OPENCLAW_HOME=/tmp/openclaw-proof-openai-invalid-XXXXXX pnpm openclaw models auth login --provider openai --method api_key

Evidence after fix:

Default OpenAI login entered the ChatGPT/Codex OAuth flow, not the direct API-key prompt:

OPENCLAW_HOME=/tmp/openclaw-proof-openai-login-4eTqAz pnpm openclaw models auth login --provider openai

◇  OpenAI Codex OAuth

Browser will open for OpenAI authentication.
If the callback doesn't auto-complete, paste the redirect URL.
OpenAI OAuth uses localhost:1455 for the callback.

Open: https://auth.openai.com/oauth/authorize?...originator=openclaw
◒  Complete sign-in in browser…

The explicit API-key path still went to the API-key prompt:

OPENCLAW_HOME=/tmp/openclaw-proof-openai-api-key-MJEzVn pnpm openclaw models auth login --provider openai --method api-key

◆  Enter OpenAI API key

The explicit code-based login still went to the Codex device-code flow:

OPENCLAW_HOME=/tmp/openclaw-proof-openai-device-dwLu9l pnpm openclaw models auth login --provider openai --method device-code

◇  OpenAI Codex device code

Open this URL in your browser and enter the code below.
URL: https://auth.openai.com/codex/device
Code: [redacted]
Code expires in 15 minutes. Never share it.

A misspelled explicit method now fails before opening OAuth:

OPENCLAW_HOME=/tmp/openclaw-proof-openai-invalid-XXXXXX pnpm openclaw models auth login --provider openai --method api_key

Error: Unknown auth method. Run openclaw models auth login --provider openai without --method to choose interactively.

Observed result after fix: Bare --provider openai resolves through the setup provider and starts ChatGPT/Codex OAuth. The API-key and device-code methods remain available only when requested explicitly with --method api-key or --method device-code. Unknown explicit methods now fail closed instead of falling through to OAuth.

What was not tested: Completing the OAuth, device-code, or API-key credential write was intentionally skipped. The proof verifies command routing and prompt selection, because the behavior changed in this PR is which auth flow OpenClaw chooses before credentials are entered.

clawsweeper · 2026-05-11T22:03:57Z

Codex review: needs real behavior proof before merge.

Summary
The branch makes OpenAI provider login/listing treat openai as the friendly ChatGPT/Codex auth path while keeping API-key setup explicit and updating docs, tests, and changelog.

Reproducibility: yes. for the review finding: source inspection shows a non-matching opts.method reaches the new OAuth fallback in pickProviderAuthMethod. I did not run the CLI because this review is read-only.

Real behavior proof
Needs real behavior proof before merge: The PR body/comments do not include after-fix real CLI output; the contributor should add redacted terminal output, logs, screenshot, or recording and update the PR body so ClawSweeper can re-review.

Next step before merge
Needs author revision for the explicit-method regression, contributor-provided real CLI proof, and maintainer review for the protected product-facing auth default change.

Security
Cleared: No new dependency, workflow, permission, secret-printing, or downloaded-code execution concern was found in the diff.

Review findings

[P2] Reject unknown methods before defaulting to OAuth — src/commands/models/auth.ts:196-198

Review details

Best possible solution:

Keep the branch open for maintainer review, preserve the manifest/runtime alignment fixes, reject unknown explicit auth methods before OAuth fallback, and require redacted real CLI proof for the login/list flows.

Do we have a high-confidence way to reproduce the issue?

Yes for the review finding: source inspection shows a non-matching opts.method reaches the new OAuth fallback in pickProviderAuthMethod. I did not run the CLI because this review is read-only.

Is this the best way to solve the issue?

No; defaulting bare login to OAuth may be a reasonable direction, but the patch should preserve strict handling for explicit --method values and include real behavior proof before merge.

Full review comments:

[P2] Reject unknown methods before defaulting to OAuth — src/commands/models/auth.ts:196-198
When --method is present but misspelled, pickAuthMethod returns null and this new fallback immediately chooses OAuth. That makes commands such as openclaw models auth login --provider openai --method api_key open the ChatGPT login path instead of failing or asking the user to choose, which is especially risky now that the docs tell users to pass --method api-key for API-key setup.
Confidence: 0.87

Overall correctness: patch is incorrect
Overall confidence: 0.86

What I checked:

Live PR state: Public GitHub API shows the PR is open at head 1017e31 with labels including maintainer, cli, commands, docs, and extensions: openai. (1017e314e666)
Real behavior proof missing: The PR body describes the intended login/list behavior, and the only issue comment is an earlier ClawSweeper review asking for proof; there is no later redacted terminal output, screenshot, recording, or log showing the changed CLI behavior after the fix. (1017e314e666)
Explicit method regression: The PR adds an OAuth fallback immediately after pickAuthMethod returns null, so an explicit but unknown --method value now falls through to OAuth instead of being rejected or prompting. (src/commands/models/auth.ts:196, 1017e314e666)
Current main comparison: Current main only returns a requested method when it matches; after a non-match it either uses the sole method or prompts among available methods, with no unconditional OAuth fallback. (src/commands/models/auth.ts:192, 9be43d5a8d96)
OpenAI alias implementation: The PR registers openai OAuth/device-code setup methods that delegate to the existing OpenAI Codex auth provider, making --provider openai able to return openai-codex profiles. (extensions/openai/setup-api.ts:46, 1017e314e666)
Manifest/control-plane alignment: The latest PR head now adds openai OAuth and device-code auth choices and updates the openai API-key choice metadata, resolving the earlier static-manifest mismatch concern. (extensions/openai/openclaw.plugin.json:763, 1017e314e666)

Likely related people:

Peter Steinberger: Current-main blame and path history for the model auth command, OpenAI setup provider, OpenAI manifest auth choices, and auth-list command point primarily to this author; the available checkout history is shallow/grafted, so this is a routing signal rather than exclusive ownership. (role: recent area contributor; confidence: medium; commits: 7e97ddcd5125, eeef4864494f; files: src/commands/models/auth.ts, src/commands/models/auth-list.ts, extensions/openai/setup-api.ts)

Remaining risk / open question:

The PR still lacks after-fix proof from a real openclaw models auth login --provider openai or openclaw models auth list --provider openai run.
The protected maintainer label and product-facing auth-default change require explicit maintainer handling before merge.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9be43d5a8d96.

pashpashpash · 2026-05-11T22:49:02Z

Addressed the latest review/CI issues in 1017e314e6.

The OpenAI auth setup metadata is now aligned between the runtime setup provider, static plugin manifest, and provider contract surface. The openai alias exposes ChatGPT login/device pairing plus the explicit API-key path, while openai-codex remains the legacy/internal spelling.

The login path now also clears stale lockouts for delegated result providers, so openclaw models auth login --provider openai clears the returned openai-codex:* subscription profile state as well as the selected openai:* profile state.

The checks-node-core-fast failure was test isolation fallout in the shared unit-fast lane. I removed the brittle module-reset mocks from the provider-flow and image/video provider-registry tests and verified the exact failing shard locally with OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test:unit:fast.

pashpashpash · 2026-05-11T23:09:07Z

Follow-up in c758dd0306: the explicit --method path now fails closed when the method is unknown, so --method api_key no longer falls through to ChatGPT OAuth. I added a regression test for that case and included a real CLI negative smoke in the PR body's proof section.

The proof section is now in the fielded format required by the Real behavior proof gate, and the previous provider-registry/core-fast failure has been addressed by the test isolation fixes on this branch.

* fix(openai): default provider login to ChatGPT auth * fix(openai): align auth login metadata and fast tests * fix(openai): prefer setup auth providers for login * fix(openai): reject unknown explicit auth methods * fix(line): keep channel entry imports scoped # Conflicts: # src/commands/models/auth-list.ts

* fix(openai): default provider login to ChatGPT auth * fix(openai): align auth login metadata and fast tests * fix(openai): prefer setup auth providers for login * fix(openai): reject unknown explicit auth methods * fix(line): keep channel entry imports scoped

fix(openai): default provider login to ChatGPT auth

6643695

openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes commands Command implementations extensions: openai size: M maintainer Maintainer-authored PR labels May 11, 2026

fix(openai): align auth login metadata and fast tests

1017e31

openclaw-barnacle Bot added size: L and removed size: M labels May 11, 2026

pashpashpash added 2 commits May 11, 2026 15:59

fix(openai): prefer setup auth providers for login

7549407

fix(openai): reject unknown explicit auth methods

c758dd0

openclaw-barnacle Bot added the channel: line Channel integration: line label May 11, 2026

fix(line): keep channel entry imports scoped

36ae14d

pashpashpash merged commit 3b44dfc into main May 11, 2026
110 checks passed

pashpashpash deleted the codex/openai-auth-login-default branch May 11, 2026 23:17

vincentkoc mentioned this pull request May 16, 2026

fix(auth): serialize auth login writes #82569

Merged

clawsweeper Bot mentioned this pull request May 18, 2026

[Bug]: Codex device-code auth method dropped in 2026.5.12 after externalization #83558

Closed

clawsweeper Bot mentioned this pull request Jun 20, 2026

fix: Codex startup plugins + WhatsApp history & Docker Codex OAuth #77748

Open

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Make OpenAI auth login use ChatGPT by default#80790

Make OpenAI auth login use ChatGPT by default#80790
pashpashpash merged 5 commits into
mainfrom
codex/openai-auth-login-default

pashpashpash commented May 11, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 11, 2026 •

edited

Loading

Uh oh!

pashpashpash commented May 11, 2026

Uh oh!

pashpashpash commented May 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

pashpashpash commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Real behavior proof

Uh oh!

clawsweeper Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pashpashpash commented May 11, 2026

Uh oh!

pashpashpash commented May 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pashpashpash commented May 11, 2026 •

edited

Loading

clawsweeper Bot commented May 11, 2026 •

edited

Loading