Files
codex-oauth-plus-onboarding…/skill/codex-oauth-plus-onboarding/references/openai-add-phone-5sim-sms-activation-2026-05-10.md
T
2026-05-10 08:45:11 +08:00

4.3 KiB
Raw Blame History

OpenAI add-phone with 5sim SMS activation — 2026-05-10

Context

During a manual ChatGPT/Codex OAuth onboarding run, ClawEmail verification succeeded and the OpenAI/Codex OAuth flow reached https://auth.openai.com/add-phone.

Important correction from BOSS: phone verification must use SMS activation, not WhatsApp receive channels.

Original extension behavior confirmed

The repo's provider phone-sms/providers/five-sim.js uses 5sim activation orders:

  • Provider: 5sim
  • Product/service: openai
  • Operator: any by default
  • Default country: vietnam
  • API pattern:
    • Buy: /v1/user/buy/activation/{country}/{operator}/openai
    • Poll: /v1/user/check/{activationId}
    • Finish: /v1/user/finish/{activationId}
    • Cancel: /v1/user/cancel/{activationId}
    • Ban: /v1/user/ban/{activationId}
  • Extract SMS code from latest sms[].code or digits in sms[].text.

This is a normal SMS OTP workflow, not WhatsApp.

Observed OpenAI behavior

OpenAI add-phone page may reject some 5sim SMS numbers immediately after submission:

  • Vietnam +84 5sim openai activation: OpenAI displayed 无法向此电话号码发送验证码。请稍后重试或使用其他号码。
  • USA +1 5sim openai activation: same rejection.
  • Indonesia +62 activation: DOM-level country selection was reverted by the page back to USA, so the number was parsed as +1 and became invalid.

Automation pitfall

The OpenAI country selector on add-phone can appear as a select, but setting it via JS/CDP may be reverted by the app state. For non-default countries, prefer visible UI automation (click dropdown/search/select country) rather than just select.value=....

If the page defaults to USA +1, using a USA activation avoids country-selector mismatch, but OpenAI may still reject the virtual number.

  1. Follow the configured 5sim country first. If FIVE_SIM_COUNTRY_ID is empty, the original extension default is vietnam; do not silently switch countries just because some numbers are rejected.
  2. Before buying or submitting another non-USA number, stabilize and verify the OpenAI page country selector first. Use visible UI automation to select the country and then confirm via CDP that the visible country button is the expected country (for example 越南 (+84)). If the page has reverted to 美国 (+1), do not buy/submit a Vietnam number; fix the selector first to avoid wasting activations.
  3. Submit the local number without the country code only after the page country is verified.
  4. If OpenAI rejects the number before SMS is sent (无法向此电话号码发送验证码 / invalid phone), cancel the activation immediately via /v1/user/cancel/{activationId} and retry with a new number in the same configured country.
  5. Only switch countries when BOSS changes the config or explicitly approves a fallback-country attempt. Good fallback candidates from the original extension support matrix are england, japan, germany, and thailand; avoid changing to these automatically.
  6. Once OpenAI accepts and sends SMS, poll /v1/user/check/{activationId} until a 48 digit code appears.
  7. After successful verification, call /v1/user/finish/{activationId}.
  8. If timeout or wrong/rejected number, call /v1/user/cancel/{activationId} and continue according to the same configured-country policy.

Session-specific pitfalls observed later

  • A batch retry script accidentally bought and submitted another Vietnam number after the page country had reverted to USA. The result was 电话号码无效 because the Vietnam number was parsed as +1, not because the Vietnam number had been genuinely tested. Future retries must check country == expected immediately before buying/submitting.
  • CDP Runtime.evaluate may time out after clicking submit while the page/network is busy; always re-query page state afterward before deciding whether the page advanced, rejected, or simply did not submit.
  • 5sim cancel can return HTTP 400 when the order is already non-cancellable or state changed; treat it as a status to report/check, not as proof a new SMS should be bought immediately.

Sensitive handling

Do not print or paste 5sim API keys, full phone numbers, OpenAI OAuth callback codes, Codex2API admin keys, or passwords. Mask phone numbers in logs/replies.