GPTsAppEarliest supported layer
Rules distinguish availability, discovery, parsing, configuration, dependency, connection, authentication, registration, exposure, activation, authorization, execution, and persistence.
Codex capability diagnosis
Where did the Codex OAuth flow fail?
Paste only the redacted OAuth stage, HTTP status, provider, and callback outcome. Never paste access or refresh tokens.
Local redaction. Save only by choice.
Diagnosis workspace
Not checkedEvidence in.
One useful next step.
Your result appears here after you review and submit the sanitized evidence.
- First supported boundary
- Waiting for evidence
- Next check
- Not selected yet
- Private report
- Not created
Worked example — not your diagnosis Authentication A compact output computed by the current deterministic ruleset. AUTHENTICATED
Example evidence
The connector reaches the OAuth callback, but the authorization-code exchange returns invalid_grant. No access or refresh token is included here.
Result
Authentication · AUTHENTICATED
The earliest supported failure is authentication: connection reached an identity boundary, but the current session did not establish a valid authenticated principal.
Why this boundary
The supplied evidence names an unauthenticated response, token/grant failure, sign-in requirement, or OAuth callback/exchange failure.
Next safe check
Identify the authentication target before retrying
Separate Codex sign-in from a connected provider's authentication before choosing a login or changing credentials.
Method and limits
A capability chain, not an AI guess
- Redacted on this device
- Inspectable deterministic ruleset · 15 checkpoints
- Saved only when you choose
Deterministic rules over your redacted evidence. What the tool cannot support, it declines to claim.
Evidence before verdict
A rule must meet a deterministic threshold. Conflicting or incomplete evidence becomes partial or unknown; it is not converted into a confident root cause.
No unknown execution
The site does not install capabilities, execute packages, contact private endpoints, edit configuration, or ask for credentials.
Private by explicit choice
A diagnosis is stateless by default. Saved reports use random URLs, expire after seven days, can be deleted immediately, and are excluded from indexing.