When using VS Code Remote SSH to connect to a remote server and log in to Codex, many users encounter the following issues:

• Token exchange failed: token endpoint returned status 403 Forbidden
• Login is successful, but the plugin remains stuck on "Thinking…"

In most cases, these issues are not caused by the plugin itself but by restricted network access on the remote server.

This article provides a set of feasible solutions applicable when:

• The server cannot directly access external network services.
• The local network environment is normal.
• SSH can be used for port forwarding.

I. Root Cause of the Problem

This issue is typically caused by one of the following:

1. The remote server cannot access the authentication interface.
2. The server's network proxy is not configured or is incomplete.
3. VS Code Server did not inherit the local network environment.

Simply put: the authentication request is sent, but the server cannot get the correct response.

II. Overall Solution Strategy

The core solution strategy is as follows:

1. Complete the login authentication locally.
2. Synchronize the authentication information to the server.
3. Use SSH for port forwarding.
4. Configure proxy environment variables on the server.
5. Restart VS Code Server.

III. Complete Codex Login Locally

⚠️ Note: This step must be performed under normal local network conditions.

Steps:

1. Open VS Code locally (do not connect to the remote server).
2. Install the Codex plugin.
3. Complete the login process.

After successful login, an authentication directory will be generated:

C:\Users\\.codex

IV. Copy Authentication Information to the Server

Copy the .codex folder to the server:

scp -r C:\Users\\.codex user@server:~/

After copying, ensure the server directory is:

~/.codex

Then reconnect via SSH.

At this point, the remote environment should typically recognize the login status.

V. Configure SSH Port Forwarding (Crucial Step)

If the server cannot directly access the external network, you need to use local network forwarding.

Open the SSH configuration file:

~/.ssh/config

Add to the corresponding host configuration:

RemoteForward 7897 127.0.0.1:7897

Explanation:

• 7897 is the local proxy port (must be consistent with your local setup)

• Common ports:

  • Clash: 7890 / 7897
  • SOCKS: 1080

Reconnect SSH after configuration is complete.

VI. Configure Server Proxy Environment Variables

Edit the server's ~/.bashrc:

export HTTP_PROXY=http://127.0.0.1:7897
export HTTPS_PROXY=http://127.0.0.1:7897
export ALL_PROXY=http://127.0.0.1:7897

Make the configuration effective:

source ~/.bashrc

VII. Restart VS Code Remote Server

Execute in VS Code:

Ctrl + Shift + P

Enter and select:

Remote-SSH: Kill VS Code Server on Host

Then reconnect to the server

(Insert image: VS Code Command Palette screenshot)

VIII. Verify Proxy Effectiveness

Execute on the server:

curl -v --proxy http://127.0.0.1:7897 https://chat.openai.com

If normal HTTP information is returned, the forwarding is successful.

IX. Principle Analysis (Simple Understanding)

The entire process is essentially:

```html
Server Request
   ↓
SSH RemoteForward
   ↓
Local 127.0.0.1:7897
   ↓
Local Proxy Tool
   ↓
Access External Service Interface

In other words:

The server is borrowing your local network capabilities

X. Summary

If you encounter:

• 403 Token Error
• Codex keeps Thinking

You can troubleshoot using this process:

✔ Log in locally first
✔ Sync .codex
✔ Configure SSH forwarding
✔ Set proxy environment variables
✔ Restart VS Code Server

This should basically solve the problem.