Codex Request Blocked? Here Is Why and How to Fix It

Quick Answer

A "Request blocked" error from Codex means your request never reached the model — it was stopped before execution. Unlike a timeout (which happens when a request hangs and gives up) or a quota error (which means you have run out of allowed usage), a block is usually caused by one of five things: regional restrictions, a blocked IP address, proxy or VPN interference, an invalid or missing API key, or content-policy filtering. This article walks through each cause and the exact fix.

If you see this error repeatedly from a restricted network or region, the most reliable fix is to route Codex through a stable API gateway like TeamoRouter, which gives you a clean endpoint that does not depend on your local network reaching OpenAI directly.

"Request Blocked" vs "Timeout" vs "Quota Exceeded"

These three errors are frequently confused, but they have different root causes and different fixes.

Understanding which one you are looking at matters, because the fixes barely overlap. A block will not be fixed by increasing a timeout, and a quota error will not be fixed by changing your proxy.

The 5 Most Common Causes of "Codex Request Blocked"

1. Regional Restriction

OpenAI restricts access from certain regions. If your IP address is in a region that is not supported, Codex may refuse requests outright. This is the most common cause for developers outside supported markets and is unrelated to the quality of your code or your API key.

How to confirm: check your public IP and see which region it belongs to, then compare against OpenAI's supported regions.

2. Blocked IP Address

Even inside a supported region, your IP can be flagged. Shared IPs (from some VPN providers or office NATs) that have been abused by other users can end up on blocklists, which makes otherwise-valid requests fail. Datacenter IPs are also more likely to be filtered than residential ones.

3. Proxy or VPN Interference

A misconfigured proxy can intercept the request and return a block-like response. This is especially common with transparent proxies, corporate firewalls, or DNS-level filtering that hijacks api.openai.com. The request never reaches OpenAI at all — the middlebox "blocks" it.

4. Missing, Expired, or Invalid API Key

If the API key is not set, is expired, has been revoked, or is missing the required permission, the request is rejected before it is executed. In some CLI configurations the key is read from the wrong environment variable, which silently sends requests without authentication.

5. Content-Policy Filtering

Less common, but a request that trips the model provider's content policy can be refused with a block-style error. This usually affects a specific prompt rather than all requests. If every prompt is blocked, look at the other causes first.

How to Diagnose Which Cause It Is

Run a minimal request to isolate the problem. The fastest diagnostic is a raw HTTPS call with curl:

curl -sS https://api.openai.com/v1/models \
  -H "Authorization: Bearer $OPENAI_API_KEY"

Interpret the output:

• Request blocked / 403 even with a valid key → regional restriction or blocked IP.
• Connection error / no response → your network cannot reach the endpoint (proxy/firewall issue, closer to a timeout root cause).
• 401 Unauthorized / invalid key → authentication problem.
• 429 / quota → billing or rate-limit issue, not a block.

A quick second check is to test the same curl command from a different network — a mobile hotspot, for example. If it works there, your IP or local network is the blocker.

How to Fix "Codex Request Blocked"

Fix 1: Set Up a Reliable Network Path (Most Common)

If your region or IP is the problem, a VPN to a supported region can help, but VPNs come with their own instability and can themselves be flagged. The more durable fix is to route through an API gateway that owns stable connectivity. With a gateway, Codex connects to an endpoint that is reachable from your network, and the gateway forwards to OpenAI from infrastructure in a supported region.

# ~/.codex/config.toml
model = "gpt-5.6-codex"
model_provider = "teamo"

[model_providers.teamo]
name = "TeamoRouter"
base_url = "https://api.teamorouter.com/v1"
env_key = "TEAMO_API_KEY"

Set the key in your shell environment:

export TEAMO_API_KEY=tr_xxxxxxxx
codex

With this configuration, Codex sends every request to the gateway's endpoint instead of api.openai.com, which removes the regional/IP block at the source.

Fix 2: Verify Your API Key and Environment

Make sure the key is actually being read. Codex reads the provider key from the environment variable named in your config (env_key). Confirm it is set and has the right scope:

# Confirm the variable is set (without printing the whole key)
test -n "$TEAMO_API_KEY" && echo "key is set" || echo "key missing"

# Confirm Codex sees the provider
codex login status

If you recently rotated or revoked a key, generate a new one in the console and update the environment.

Fix 3: Rule Out Proxy Interference

If your shell has proxy variables set from another tool, they can interfere:

# Inspect current proxy settings
env | grep -i proxy

# For a clean test, unset them and retry
unset http_proxy https_proxy all_proxy
codex "Say hello"

If unsetting the proxy fixes it, your proxy configuration is the culprit — either fix it or bypass it for Codex traffic. Also check the NO_PROXY variable so it covers the gateway host you use.

Fix 4: Check Whether the Block Is Prompt-Specific

Test with a trivial prompt:

codex "Reply with exactly: OK"

If a trivial prompt succeeds but a specific prompt is blocked, the block is content-policy related. Rephrase the prompt and avoid patterns that trip filtering. If even the trivial prompt is blocked, the cause is almost certainly network, IP, or auth — not content.

Fix 5: Switch Networks to Confirm the Diagnosis

Run the same command from a different network (mobile hotspot, a colleague's connection, or a different region). If it works, your local network or IP is blocked. This single test separates "the provider is blocking me" from "my network is blocking me."

Preventing "Request Blocked" in the Future

• Use a stable endpoint. A gateway gives you one endpoint that works regardless of your local IP or network, which eliminates the most common recurring cause.
• Keep API keys valid and scoped. Rotate them on a schedule and avoid committing them to source control.
• Don't rely on shared VPN IPs. If you must use a VPN, prefer a dedicated IP if available.
• Separate diagnostic errors. Log whether a failure is blocked, timeout, or quota so you apply the right fix instead of guessing.

When to Treat It as a Timeout Instead

If the request hangs for a long period and then returns an error mentioning timed out, you have a connectivity problem, not a block. Increase client-side timeout and retry settings, check the health of the endpoint, and reduce the size of very large requests. The fixes in this article (routing through a gateway, checking proxy) still help, but the diagnostic path is different.

A Diagnostic Checklist You Can Copy

When you hit a block, run through this list in order:

# 1. Is the endpoint reachable at all?
curl -sS -o /dev/null -w "HTTP %{http_code} in %{time_total}s\n" \
  https://api.openai.com/v1/models \
  -H "Authorization: Bearer $OPENAI_API_KEY"

# 2. Is your API key set and visible to Codex?
test -n "$TEAMO_API_KEY" && echo "key set" || echo "key missing"

# 3. Are stale proxy variables interfering?
env | grep -i proxy

# 4. Is the block prompt-specific?
codex "Reply with exactly: OK"

Write down which step fails. That single observation tells you which of the five causes you are dealing with and which fix from this article applies.

Frequently Asked Questions

Is "Request blocked" the same as a 429 rate-limit error?

No. A 429 means your request was understood but you exceeded a rate limit or quota. A block means the request was refused before processing — often a 403-style refusal related to region, IP, or authentication. The fixes are different, so identify which one you actually see.

Can a VPN cause a "Request blocked" error?

Yes. Some VPN IPs are shared and may be blacklisted, and some VPN providers sit in regions OpenAI filters. If a block appears only when the VPN is on, try a different server, a dedicated IP, or route through a gateway instead.

Will changing my API key fix a regional block?

Only if the block is authentication-related. If your region or IP is blocked, a new key changes nothing. Test the raw curl from the same network — if it still says blocked, the key is not the problem.

Does TeamoRouter work for Codex if I am in a restricted region?

Yes. TeamoRouter provides an endpoint that is reachable from restricted networks and forwards requests to OpenAI from supported infrastructure, which removes regional and IP-based blocks by design. It also keeps prompt caching intact, so you do not trade connectivity for higher token costs.

Bottom Line

"Codex Request blocked" is a distinct error with a short list of causes: region, IP, proxy, auth, or content policy. Diagnose with a single curl, fix the root cause, and you will be back to work quickly. For developers on restrictive networks, the cleanest long-term fix is to route Codex through an API gateway like TeamoRouter — it removes regional and IP blocks by design, keeps your API key valid and scoped, and gives you one stable endpoint to rely on.