Codex

Codex 403 "Codex cannot verify the owner of this model request"

Last checked Nov 10, 2026

The error

unexpected status 403 Forbidden: Codex cannot verify the owner of this model request. Start a fresh request before retrying.

Seen in OpenClaw when an agent uses Codex through ChatGPT sign-in (OAuth). The error code underneath is model_permission_denied.

Codex refuses a model request when it cannot tie it to the session that started it. In OpenClaw this shows up after switching an agent's model in place (issue #162119) or when an idle native Codex child is given new work (issue #165739). OpenClaw 2026.10.10 fixed one cause: native Codex children no longer inherit an expired startup context. Start a fresh request or spawn a fresh child, update to 2026.10.10 or later, and restart the Gateway if other agents now say the auth profile is temporarily unavailable.

Why it happens

The request reached Codex with an ownership context Codex no longer accepts, usually from a long-lived child or a session whose model was switched after it started. Codex returns 403 with model_permission_denied and asks for a fresh request.

An in-place model switch on a running session (openclaw/openclaw#162119, reported on 2026.9.7).
Re-tasking an idle native Codex child instead of spawning a new one (#165739). The workaround on that issue is to spawn a fresh child.
An older OpenClaw build. The 2026.10.10 notes say native Codex children can now make model requests after startup without inheriting an expired startup context, which addresses both issues above, though they are still open.
Knock-on failures. OpenClaw can misread this local refusal as an auth failure and put the shared OpenAI sign-in into cooldown, so other agents then fail with "Auth profile ... is temporarily unavailable" (#191473, fix in open PR #191562).

The fix

1 Do what the message says: start a fresh request. For a sub-agent, spawn a new Codex child rather than reusing the idle one.
2 Avoid switching the model on a running session. Start a new session on the model you want.
3 Check your version with openclaw gateway status and update to 2026.10.10 or later if you are older.
4 If other agents now fail with "Auth profile ... is temporarily unavailable", restart the Gateway to clear the cooldown: openclaw gateway restart.
5 Confirm which ChatGPT account the agent signs in with. If it was changed recently, sign in again through the Codex OAuth flow.

openclaw gateway restart

Still failing?

It comes back after every restart. Follow #191473: the cooldown misclassification is not fixed in a release yet.
The turn fails with "admission is closed" instead. That is the session database bug, see the page below.

Hit a different error?

Paste any agent error and get the cause and fix in seconds.

Open the decoder

Frequently asked questions

What does "Codex cannot verify the owner of this model request" mean?

Codex could not match the request to the session that is allowed to make it, so it refused with 403 model_permission_denied. In OpenClaw it follows an in-place model switch or a reused idle Codex child.

Does restarting the OpenClaw Gateway fix it?

Often for a while. A restart clears the auth cooldown that the error can trigger, but it does not stop the cause. Spawn fresh children and avoid in-place model switches as well.

Is my ChatGPT account blocked?

Usually not. The refusal is about the request's session context, not the account. If it persists across fresh sessions, check which account the agent uses and sign in again.

Which OpenClaw version fixes it?

2026.10.10 fixed one cause, expired startup context in native Codex children. The issues are still open as of 10 November 2026, so update and use the workarounds.

Stop firefighting agent errors

Decoding errors one at a time is the manual version of what BetterClaw automates. Run your agents on a no-code AI agent platform with managed models, retries and config validation built in.

Deploy Your Agent — Start Free Book a Demo

Free plan available · Pro $49/mo · BYOK · 7-day free trial