The ChatGPT setting that makes device-code sign-in work
Enable Codex device-code login in ChatGPT Security settings or workspace permissions, start a fresh sign-in, and distinguish account, code and model errors.
If Codex asks you to enable device code sign-in, open ChatGPT’s Settings → Security and login and turn on the switch Enable device code sign-in for Codex, Excel, PowerPoint, and Word. That covers a personal account; for a workspace account, an admin controls it in workspace permissions. Then start a fresh sign-in, open the URL it prints and enter the new code. This is the personal/workspace split documented in OpenAI’s headless sign-in instructions.
The message reads, as of October 2026:
Enable device code sign-in for Codex, Excel, PowerPoint, and Word
in ChatGPT security settings, then run "codex login --device-auth"
again.Its earlier wording, “Enable device code authorization for Codex in ChatGPT security settings”, points at the same setting.
What device-code authorization does
The terminal displays a code; you approve that sign-in in a browser. The browser can be on a different computer from the tool you are signing into. OpenAI recommends this beta flow for headless machines and for setups where the ordinary browser login cannot reach its localhost callback.
A normal browser-based Codex sign-in does not use this permission. Device-code login is not limited to servers, either: a laptop can use it when its usual callback is blocked. The same switch lets ChatGPT’s Excel, PowerPoint and Word add-ins sign in with a code, which is why the message names them.
Enable it, then start the right sign-in
- Check the account. In the browser, sign into the ChatGPT account you want the tool to use. Under Settings → Security and login, turn on the device code sign-in switch, or ask the workspace admin to enable the workspace permission.
- Start a fresh attempt. For Codex CLI, run:If you are connecting OpenClaw instead, use its own documented sign-in command:
Copiedcodex login --device-authThese commands sign into different tools; use the one you are setting up.
Copiedopenclaw models auth login --provider openai --device-code - Approve your code in the browser. Open the printed URL, enter the code and complete the approval. If the link opens in a browser without your ChatGPT session, sign in there or move it to the browser you normally use.
- Check the terminal finishes. For Codex CLI, use
codex login statusto check the active login, then try a small task. For OpenClaw, send a test message to your agent. Authentication and permission to use the selected model are separate checks.
If the new code still fails
- The code expired: restart the command and use the new code, not one left open while you changed settings.
- The error names your workspace admin: the personal setting is not the permission being refused. Follow the workspace-device-code fix and confirm you are signing into the intended workspace.
- Login works but the model is unsupported: choose a model available to that account. The ChatGPT/OpenClaw setup guide separates this from a sign-in failure.
- OpenClaw says pairing is required: that is a different approval, covered by the pairing error guide.
Only approve a code from a sign-in you started. If device-code login is unavailable, OpenAI also documents browser-based alternatives for Codex CLI, including forwarding the callback over SSH. On a work account, use a method your organization permits.