“Please contact your workspace admin to enable device code authentication” — the fix
A Codex sign-in error asking for your workspace admin is a permission issue. What the admin enables, how to retry, and supported alternatives if it stays off.
A device-code error telling you to contact your ChatGPT workspace admin points to a workspace permission, not a mistake in the code you entered. Ask an admin to enable device-code login in the workspace permissions, then start a fresh sign-in. Changing your personal Security setting does not grant a permission the workspace controls. OpenAI documents the two settings in its headless authentication guide.
Why the same account can work on a laptop
The ordinary browser login and the device-code flow are different sign-in methods. Codex CLI normally opens a browser and waits for a localhost callback. Device-code login lets you approve the terminal’s sign-in from another browser, which is useful on a server or when that callback is blocked.
Success with the first method does not enable the second. Buying a different ChatGPT plan or repeatedly requesting new codes does not resolve a workspace permission refusal. If you intended to use a personal account, first check which account and workspace the browser selected.
What your admin needs to know
Ask for device-code authentication for Codex in the workspace permissions, explain which tool and machine you need to sign into, and include the error text. The request is to permit a sign-in method, not to increase your model allowance. An admin should also check that your workspace role permits Codex access.
Once the permission is enabled, run a new attempt on the machine that needs access. For Codex CLI:
codex login --device-authFor OpenClaw, use its own OpenAI device-code sign-in:
openclaw models auth login --provider openai --device-codeOpen the printed link, use the intended ChatGPT account and approve that attempt’s code. Wait for the terminal to confirm completion. A code left open while permission was being arranged may have expired.
If the workspace keeps device-code login disabled
Ask which supported method your organization allows. OpenAI’s Codex CLI documentation includes a browser login with its callback forwarded over SSH, and an authenticated-cache transfer to a trusted headless machine. Those are alternatives to the device-code flow, not authorization to disregard a workspace policy. Credential transfer needs the same care as handling a password.
An approved API key is another option. It uses separate API billing rather than the ChatGPT subscription allowance, so confirm the organization’s budget and access controls before switching. Codex CLI’s fallback instructions should not be assumed to configure OpenClaw as well; its subscription connection has its own sign-in and model selection.
If permission is enabled but access still fails
Check the browser’s selected account and workspace, then distinguish a login failure from a model-access error. For Codex CLI, codex login status checks whether a login is active; a small task checks that it can actually run. For a personal account that is refusing device codes without a workspace involved, use the personal Security-settings guide.