returns 401 while Codex CLI works normally

[Zoean-z]

What version of HAPI is running?

0.16.1

What platform is your computer?

Windows11 x86

What issue are you seeing?

Running npx @twsxtd/hapi codex fails with HTTP 401 even though the Codex CLI works normally.

codex CLI works correctly

codex login status shows authenticated using an API key

hapi hub --relay starts successfully

Hub web interface loads normally

However, starting Codex through HAPI fails:

PS C:\Users\Lenovo> npx @twsxtd/hapi codex

Error: Request failed with status code 401
Failed to execute: ...\hapi.exe codex
Binary exited with status 1

This only happens when running Codex through HAPI.
Running codex directly works without any issue.

What steps can reproduce the bug?

Install Codex CLI and HAPI globally:

npm install -g @openai/codex
npm install -g @twsxtd/hapi

Login to Codex using an API key:

codex login
codex login status

Output:

Logged in using an API key - sk-proj-****

Start HAPI hub:

npx @twsxtd/hapi hub --relay

Hub starts successfully.

In another terminal run:

$env:HAPI_API_URL="http://localhost:3006"
npx @twsxtd/hapi codex

The command fails with:

Error: Request failed with status code 401

Notes:

codex CLI works normally outside of HAPI

Proxy environment variables were cleared

Hub is running and accessible at http://localhost:3006

What is the expected behavior?

No response

Additional information

No response

[github-actions]

I checked the current hapi codex startup path, and the verified 401 path in this repo is HAPI hub authentication, not Codex API-key login.

hapi codex first loads CLI_API_TOKEN, ensures a machine ID exists, and bootstraps a HAPI session before it launches Codex. That bootstrap sends Authorization: Bearer <token> to the hub’s /cli/machines and /cli/sessions endpoints. Those endpoints return 401 when the bearer token is missing or does not match the hub token.

I did not find code in this path that replaces your existing Codex login with a separate HAPI-specific Codex auth token. In local mode, HAPI eventually spawns codex with env: process.env, so it should inherit the normal Codex environment/state.

Because of that, the most likely interpretation from the current code is: the failure is happening before Codex itself starts, during HAPI CLI ↔ hub auth.

Relevant code:

• cli/src/commands/codex.ts:55 - hapi codex initializes HAPI token/setup before running Codex
• cli/src/agent/sessionFactory.ts:109 - bootstraps machine/session with the hub before agent launch
• cli/src/api/api.ts:22 - POST /cli/sessions with Authorization: Bearer <token>
• cli/src/api/api.ts:82 - POST /cli/machines with Authorization: Bearer <token>
• hub/src/web/routes/cli.ts:71 - hub requires Authorization header on /cli/*
• hub/src/web/routes/cli.ts:83 - hub returns 401 when token does not match configuration.cliApiToken
• cli/src/codex/codexLocal.ts:73 - local mode spawns codex
• cli/src/codex/codexLocal.ts:77 - spawned Codex process receives process.env
• hub/src/config/cliApiToken.ts:74 - hub token source priority: env, then settings.json, then auto-generated token
• hub/src/index.ts:123 - hub prints newly generated CLI_API_TOKEN on startup

Need more info:

• Please paste the output of npx @twsxtd/hapi auth status
• Did the hub print a newly generated CLI_API_TOKEN when you started hapi hub --relay?
• Does %USERPROFILE%\\.hapi\\settings.json contain the same cliApiToken that the hub is using?
• If you run with debug enabled, does the failure happen before any Spawning codex log line? ($env:DEBUG="1"; npx @twsxtd/hapi codex)

---

HAPI Bot