OpenAI auth is failing with error_code: authorize hydra invalid_request

[mabotelh]

I tried installing both through pipx and source both failed the same way.

/usr/local/bin/nadirclaw auth openai login
Logging in to OpenAI...
A browser window will open for you to sign in with your OpenAI account.

Waiting for OAuth callback on http://localhost:1455/auth/callback...

Opening browser for OpenAI authorization...
If the browser doesn't open, visit:

When I click on the URL, I get a page with the following content:

Authentication Error
Invalid authorize request
You can contact us through our help center at help.openai.com if you keep seeing this error. Include the request ID below in your message.
error_code: authorize_hydra_invalid_request

Let me know if I can help with any further logging.

[doramirdor]

Thanks for the detailed report — authorize_hydra_invalid_request is OpenAI's Ory Hydra authorization server rejecting one of the query parameters before the browser even gets a login screen. It's almost never a bug in the install (pipx vs source produced the same error, which confirms that), and our login_openai flow does construct the URL the same way for both.

What our client is sending

From nadirclaw/oauth.py (constants at the top of the file, request built in login_openai):

param	value
client_id	app_EMoamEEZ73f0CkXaXp7hrann
redirect_uri	http://127.0.0.1:1455/auth/callback
scope	openid profile email offline_access
audience	https://api.openai.com/v1
response_type	code
code_challenge_method	S256

Hydra returns invalid_request when one of those is no longer allow-listed for the client — most commonly redirect_uri, audience, or a scope. If OpenAI rotated this client_id or tightened its config (we've seen them do this without notice for the Codex CLI client before), the symptom you're seeing is exactly what we'd expect.

Two things that would help me confirm the root cause

1. Copy the full redacted authorize URL from the terminal (the one printed after "If the browser doesn't open, visit:") and paste it here with the state, code_challenge, and your client identifier removed. I want to see the exact redirect_uri and audience that Hydra is rejecting — sometimes a system proxy rewrites them.
2. Run with LOG_LEVEL=DEBUG nadirclaw auth openai login and share the debug line that starts with Authorization URL: (same redaction).

Workaround in the meantime

If you only need NadirClaw to call OpenAI (not specifically the ChatGPT-account-backed quota), you can skip the OAuth flow entirely and use a standard OpenAI API key:

export OPENAI_API_KEY=sk-…
nadirclaw serve

That bypasses oauth.py completely; the router/classifier/cache features all work the same. The OAuth flow is only required when you want to consume the ChatGPT (account-level) entitlements.

What I'm tracking

If the URL you share confirms it's a redirect_uri/audience rejection, the fix is to expose NADIRCLAW_OPENAI_CLIENT_ID / NADIRCLAW_OPENAI_AUDIENCE / NADIRCLAW_OPENAI_REDIRECT_URI env overrides so users can point at a working client config without waiting for a release. Holding off shipping that until the captured URL confirms which parameter is the culprit — I don't want to add knobs against a guess.

🤖 Automated triage reply via scheduled task (claude code, daily-check-github-status). A maintainer will follow up once you've shared the redacted authorize URL.

[doramirdor]

Found the root cause and opened a fix: #69.

login_openai() was sending redirect_uri=http://127.0.0.1:1455/auth/callback in the authorize request, while the local callback server binds and prints http://localhost:1455/auth/callback. OpenAI's Hydra authorization server exact-matches redirect_uri against the client allow-list, so the 127.0.0.1 form is rejected up front with authorize_hydra_invalid_request — which matches your symptom exactly (and explains why pipx and source behaved identically). The fix switches the authorize request to localhost, consistent with the callback server and the Antigravity/Gemini flows. Shipping in 0.19.3.

If you're able to pull the branch and confirm the login completes, that would be a great sanity check. If the error somehow persists, please paste the redacted authorize URL — there's a small chance OpenAI also tightened the client_id/audience, which would need a separate follow-up.