The ChatGPT setting that makes device-code sign-in work
Headless Codex and OpenClaw sign-ins fail until 'Enable device code authorization' is on in ChatGPT's security settings. Where it lives and the two traps after it.
Device-code sign-in fails until you flip one toggle: in ChatGPT, open your Security settings and enable device code authorization (shown as “Enable device code authorization for Codex” as of late July 2026; on a workspace account it lives in workspace permissions and needs an admin). Then rerun the sign-in, open the printed URL in a browser where you’re already signed in to ChatGPT, and enter the code.
Why this setting exists — and why you only find it mid-failure
Device-code login is the OAuth flow for machines without a browser: the tool shows a short code and a URL, and you approve the sign-in from any other device. That’s also exactly what a phishing attempt would love to automate, so OpenAI ships it off by default and labels it beta. The result is a trap for real users: nothing warns you up front, the sign-in flow starts normally, and only after you’ve entered the code does it fail — we learned about the toggle the same way everyone does, from a connect that died halfway through. Flip the setting first and the flow is genuinely smooth.
Where it applies
You’ll hit this on anything that signs in to a ChatGPT account from a headless machine. For Codex CLI that’s codex login --device-auth; for OpenClaw on a server it’s the device-code sign-in:
openclaw models auth login --provider openai --device-codeThat flow is the standard way to put your ChatGPT subscription behind an OpenClaw agent. Interactive laptop sign-ins that pop a browser don’t need the toggle at all.
The three-step fix
- 1. Enable the setting. ChatGPT → Settings → Security → enable device code authorization. Personal accounts can do this themselves; workspace members need a workspace admin to allow it in workspace permissions.
- 2. Rerun the sign-in and mind which browser opens the URL. This is the second, undocumented trip wire: if the link opens in an in-app browser (Telegram’s, say) or a browser where you’re not signed in to ChatGPT, you get a sign-in wall with no password autofill at the worst moment. Copy the URL into the browser that already has your ChatGPT session.
- 3. Enter the code and confirm. Back on the machine, the tool completes the OAuth exchange and stores tokens that refresh automatically — you won’t repeat this ritual routinely.
If it still fails
Codes are short-lived — a code that sat while you hunted for the setting is likely expired, so start the flow fresh. On workspace accounts, confirm an admin actually saved the permission change. And if the failure message mentions scopes or pairing rather than the sign-in itself, you’ve moved on to a different, OpenClaw-side approval — that error has its own guide.