The ChatGPT setting that makes device-code sign-in work
Enable Codex device-code login in ChatGPT Security settings or workspace permissions, start a fresh sign-in, and distinguish account, code and model errors.
If Codex asks you to enable device-code authorization, open ChatGPT’s Settings → Security and enable device-code login for your personal account. For a workspace account, an admin controls it in workspace permissions. Then start a fresh sign-in, open the URL it prints and enter the new code. This is the personal/workspace split documented in OpenAI’s headless sign-in instructions.
What device-code authorization does
The terminal displays a code; you approve that sign-in in a browser. The browser can be on a different computer from the tool you are signing into. OpenAI recommends this beta flow for headless machines and for setups where the ordinary browser login cannot reach its localhost callback.
A normal browser-based Codex sign-in does not use this permission. Device-code login is not limited to servers, either: a laptop can use it when its usual callback is blocked.
Enable it, then start the right sign-in
- Check the account. In the browser, sign into the ChatGPT account you want the tool to use. Enable device-code authorization in its Security settings, or ask the workspace admin to enable the workspace permission.
- Start a fresh attempt. For Codex CLI, run:
If you are connecting OpenClaw instead, use its own documented sign-in command:codex login --device-auth
These commands sign into different tools; use the one you are setting up.openclaw models auth login --provider openai --device-code - Approve your code in the browser. Open the printed URL, enter the code and complete the approval. If the link opens in a browser without your ChatGPT session, sign in there or move it to the browser you normally use.
- Check the terminal finishes. For Codex CLI, use
codex login statusto check the active login, then try a small task. For OpenClaw, send a test message to your agent. Authentication and permission to use the selected model are separate checks.
If the new code still fails
- The code expired: restart the command and use the new code, not one left open while you changed settings.
- The error names your workspace admin: the personal setting is not the permission being refused. Follow the workspace-device-code fix and confirm you are signing into the intended workspace.
- Login works but the model is unsupported: choose a model available to that account. The ChatGPT/OpenClaw setup guide separates this from a sign-in failure.
- OpenClaw says pairing is required: that is a different approval, covered by the pairing error guide.
Only approve a code from a sign-in you started. If device-code login is unavailable, OpenAI also documents browser-based alternatives for Codex CLI, including forwarding the callback over SSH. On a work account, use a method your organization permits.