Using your ChatGPT subscription with OpenClaw (Codex sign-in)
Officially supported since May 2026: your ChatGPT plan can power an OpenClaw agent. The connect commands, the headless flow, and the four details that make it stick.
Yes — since May 2026 OpenAI officially supports signing in to OpenClaw with your ChatGPT account, so your subscription’s included Codex access powers the agent instead of a per-token API bill. One CLI sign-in connects it — openclaw models auth login with the openai provider, adding --device-code on a server — it works on every ChatGPT plan including Free, and it selects gpt-5.6-family models.
What this actually is
OpenClaw needs a model to think with, and the default way to pay for one is an API key with usage-based billing. Subscription sign-in replaces that: you authenticate with your ChatGPT account through an OAuth flow, and the agent’s model calls draw on the Codex allowance your plan already includes. This isn’t a tolerated workaround — OpenAI opened it to OpenClaw explicitly in May 2026 (announced by Sam Altman, a few months after OpenClaw’s creator joined OpenAI), and the official OpenClaw docs state that OpenAI supports subscription OAuth in external tools and workflows like OpenClaw. For most people this dissolves the model-cost question: every current ChatGPT plan includes some Codex usage, Free included.
Connecting it
- On a machine with a browser:
Your browser opens, you sign in to ChatGPT, done.openclaw models auth login --provider openai - On a server or headless machine:
OpenClaw prints a short code and a URL; you open the URL on any device, sign in, and enter the code. One prerequisite trips almost everyone: a toggle in your ChatGPT security settings must be on first — the device-code authorization setting, explained here.openclaw models auth login --provider openai --device-code
A fresh sign-in selects openai/gpt-5.6-sol (the flagship tier) by default. Your plan’s allowance is a rolling window — openclaw models status shows what’s left of it at any moment.
Four things to get right (learned the hard way)
We run OpenClaw agents on subscription sign-in daily, and the connect itself is the easy half. These are the four details that decide whether it actually works the way you expect:
- Keep a fallback model configured. Subscription allowances have windows; an agent with no fallback goes silent when the window runs dry instead of degrading gracefully.
- Allowlist the exact model ids. Session-level model validation matches exact ids — a bare
openai/*wildcard can still produce “model not allowed” when you switch a live session. - Move live sessions deliberately. Long-running channel conversations stay pinned to the model they started on. Changing the default does not migrate them — switch the session explicitly or expect the change to apply to new conversations only.
- Verify at session level. Read back the live session’s effective model afterward; the config file telling you what you wrote is not the same as the conversation actually using it.
What the subscription doesn’t cover
Subscription auth covers the agent’s chat/reasoning calls — not every OpenAI API surface. Memory embeddings, text-to-speech, and realtime voice still require a platform API key or an alternative provider; the sharp edge is memory search, which silently pauses on subscription-only setups unless you point it at an embedding provider you actually have. On our hosted OpenClaw pods we pair the connect with exactly these defaults — local embeddings, a fallback model, session-level verification — so “use my ChatGPT subscription” is a sentence you say to your agent, not a checklist you maintain.