A quick diagnosis order
- Record
codex --versionorclaude --version, the requested model, selected key platform and timestamp. - Check whether the client parsed its local configuration and selected the intended provider.
- Confirm the base URL and an active matching key, without printing its full value.
- Check available balance, plan status, model access and key limits in Console.
- Run a single small client smoke test and compare the matching usage record.
If no matching record appears, the request may have failed before authenticated gateway processing; that alone does not identify which network hop failed. If a record exists, keep its reference and error detail for support.
Common status codes and next actions
| Symptom | What to check | Retry? |
|---|---|---|
| 401 authentication | Full key instead of a masked preview, active status, correct key platform, correct credential source and header. Rotate a leaked key. | After correcting credentials. |
| 403 access denied | Client/channel restrictions, workspace policy and requested feature. Read the response body; do not try to bypass policy. | After access is resolved. |
| 400 / unknown model | Exact model ID, available channel catalog, supported parameters, context size and stale client configuration. | After correcting the request. |
| 404 endpoint | Base path and protocol. Codex preset uses /v1; Claude Code preset uses the origin without that suffix. | After correcting the path. |
| 429 usage or rate limit | Error details, concurrency, key window limits, balance and reset time. A quota problem and temporary upstream saturation require different fixes. | Respect Retry-After when present; avoid a retry storm. |
| 502 / 503 / 504 | Temporary upstream/network availability, timeouts, and whether the request already produced output. | Use a small bounded retry policy with backoff and jitter. |
| Timeout / interrupted stream | Client network, corporate proxy, elapsed time and terminal completion event. Partial text is not a completed response. | Inspect status and possible prior usage before resubmitting. |
The JSON error message is more specific than an HTTP status alone. For example, several different rate and quota conditions can produce 429. Do not infer that adding credit will fix every 429, or that switching models fixes an invalid key.
Fix the common configuration traps
Codex
Put provider keys in the user config, keep top-level values before table headers, and avoid duplicate tables. Fully restart after changing authentication mode. The Codex guide includes a read-only smoke command. If an existing task behaves differently from a new task, recheck the generated preset and client version.
Claude Code
Run from the terminal where variables are set, and inspect /status. User or managed settings can override shell configuration. A dock-launched editor may not inherit exports. The Claude Code guide shows all three common shell formats.
Do not disable TLS verification, remove sandbox protections, change proxy policy or expose your API key in a URL as a workaround for an authentication error.
Send enough evidence for support
Client and version:
Operating system / shell:
UTC time of failure:
Gateway hostname and client preset:
Model ID:
HTTP status and exact error code/message:
Request reference, if available:
Does the small smoke test fail too?
Did any output arrive before failure?Send this to support@superfastai.org. Remove Authorization headers, keys, cookies, personal data, prompts and proprietary code unless a specific, appropriate support process requires them. Provide a minimal non-sensitive reproduction when possible.