bug(codex): token refresh ignores configured proxy and fails with 403 unsupported_country_region_territory unless system-wide proxy is enabled

[tdlrobin]

Describe the bug

When using Codex through CLIProxyAPI, authentication works correctly through the configured proxy, and normal requests also work.

However, the token refresh flow appears to ignore the configured proxy settings. As a result, refresh requests fail with:

403 unsupported_country_region_territory

If I enable a system-wide/global proxy, token refresh works again.

This suggests that:

• normal auth / request flow respects proxy config
• token refresh flow does not fully respect proxy config
• refresh only succeeds when a global/system proxy is enabled

Steps to reproduce

1. Configure a proxy in CLIProxyAPI for Codex usage
2. Start using Codex normally
3. Initial authentication succeeds
4. Wait until token refresh happens
5. Refresh fails with 403
6. Enable system-wide/global proxy
7. Refresh works again

Actual behavior

Token refresh fails repeatedly with logs like:

WARN openai_auth.go:285 403
Token refresh attempt 1 failed: token refresh failed with status 403: {"error":{"code":"unsupported_country_region_territory","message":"Country, region, or territory not supported","param":null,"type":"request_forbidden"}}
Token refresh attempt 2 failed: ...
Token refresh attempt 3 failed: ...

[tdlrobin]

[luispater]

unsupported_country_region_territory

Please confirm that you are in a supported country.

[tdlrobin]

Hi @luispater,

Thanks for the response, but I'd like to clarify the actual nature of this issue.

The problem is not whether I'm in a supported country/region — I fully understand that unsupported_country_region_territory typically relates to geographic location.

The actual issue is: the token refresh flow does not respect the proxy settings configured in the Auth File.

Here's what I'm observing:

Scenario	Result
Auth File with proxy → normal Codex usage	✅ Works fine, requests go through configured proxy
Auth File with proxy → wait for token refresh	❌ Refresh fails with unsupported_country_region_territory
Enable system-wide/global proxy → token refresh	✅ Refresh succeeds

This indicates:

• Normal request flow: Correctly reads and uses the proxy configuration from the Auth File
• Token refresh flow: Appears to ignore the Auth File's proxy settings and attempts direct connection, causing the request to originate from my actual location

Token refresh only succeeds when I enable a system-wide proxy, which proves that the refresh request is taking a different network path than normal requests.

Expected behavior: Token refresh should use the same Auth File proxy configuration as normal requests, as part of the Network Configuration settings.

Could you please check if the token refresh logic properly inherits the proxy configuration from the Auth File when initializing its HTTP client?

---

[tdlrobin]

Hi @luispater , I’d like to follow up on this because I believe the root cause is specifically about proxy handling in the refresh path, not general region support.

What I can reproduce consistently is:

1. Codex normal requests work when using the proxy configured in the Auth File
2. Token refresh fails with 403 unsupported_country_region_territory
3. If I enable a system-wide/global proxy, the same token refresh succeeds immediately

So the key issue seems to be:

• normal request flow respects the Auth File proxy
• token refresh flow appears not to inherit that proxy configuration
• refresh therefore goes through a different network path unless a global proxy is enabled

This is why the error looks like a region issue, but the actual bug appears to be that refresh is not using the same proxy settings as normal Codex requests.

Could you please confirm whether the token refresh HTTP client is initialized from the same proxy source as the normal request client?
If not, I think this issue may be the same root cause as the per-auth proxy handling problem.