feat(oauth): allow upstream base URL overrides

config.example.yaml

@@ -35,6 +35,12 @@ remote-management:
 # Authentication directory (supports ~ for home directory)
 auth-dir: "~/.cli-proxy-api"
 
+# OAuth auth files may optionally include base_url or base-url to override the
+# upstream endpoint for that account only. This is useful for routing one OAuth
+# account through a local gateway while leaving other accounts on the default
+# provider endpoint. Example auth file field:
+#   "base_url": "http://127.0.0.1:18081"
+
 # API keys for authentication
 api-keys:
   - "your-api-key-1"
@@ -106,6 +112,13 @@ redis-usage-queue-retention-seconds: 60
 # Per-entry proxy-url also supports "direct" or "none" to bypass both the global proxy-url and environment proxies explicitly.
 proxy-url: ""
 
+# Provider-wide upstream base URL overrides for OAuth/file-backed credentials.
+# Per-auth-file base_url/base-url values and per-api-key base-url values take precedence.
+# Empty keeps the official upstream defaults.
+# claude-base-url: "http://127.0.0.1:18081"
+# codex-base-url: "http://127.0.0.1:18082"
+
+
 # When true, unprefixed model requests only use credentials without a prefix (except when prefix == model name).
 force-model-prefix: false
 

internal/config/config.go

@@ -122,6 +122,11 @@ type Config struct {
 	// Codex defines a list of Codex API key configurations as specified in the YAML configuration file.
 	CodexKey []CodexKey `yaml:"codex-api-key" json:"codex-api-key"`
 
+	// CodexBaseURL globally overrides the upstream Codex API endpoint for
+	// OAuth/file-backed credentials that do not set their own base URL.
+	// Per-credential base URLs still take precedence.
+	CodexBaseURL string `yaml:"codex-base-url,omitempty" json:"codex-base-url,omitempty"`
+
 	// Codex configures provider-wide Codex request behavior.
 	Codex CodexConfig `yaml:"codex" json:"codex"`
 
@@ -132,6 +137,11 @@ type Config struct {
 	// ClaudeKey defines a list of Claude API key configurations as specified in the YAML configuration file.
 	ClaudeKey []ClaudeKey `yaml:"claude-api-key" json:"claude-api-key"`
 
+	// ClaudeBaseURL globally overrides the upstream Claude API endpoint for
+	// OAuth/file-backed credentials that do not set their own base URL.
+	// Per-credential base URLs still take precedence.
+	ClaudeBaseURL string `yaml:"claude-base-url,omitempty" json:"claude-base-url,omitempty"`
+
 	// ClaudeHeaderDefaults configures default header values for Claude API requests.
 	// These are used as fallbacks when the client does not send its own headers.
 	ClaudeHeaderDefaults ClaudeHeaderDefaults `yaml:"claude-header-defaults" json:"claude-header-defaults"`

internal/runtime/executor/claude_executor.go

@@ -158,7 +158,7 @@ func (e *ClaudeExecutor) PrepareRequest(req *http.Request, auth *cliproxyauth.Au
 	if req == nil {
 		return nil
 	}
-	apiKey, _ := claudeCreds(auth)
+	apiKey, _ := claudeCredsWithConfig(e.cfg, auth)
 	if strings.TrimSpace(apiKey) == "" {
 		return nil
 	}
@@ -201,7 +201,7 @@ func (e *ClaudeExecutor) Execute(ctx context.Context, auth *cliproxyauth.Auth, r
 	}
 	baseModel := thinking.ParseSuffix(req.Model).ModelName
 
-	apiKey, baseURL := claudeCreds(auth)
+	apiKey, baseURL := claudeCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://api.anthropic.com"
 	}
@@ -393,7 +393,7 @@ func (e *ClaudeExecutor) ExecuteStream(ctx context.Context, auth *cliproxyauth.A
 	}
 	baseModel := thinking.ParseSuffix(req.Model).ModelName
 
-	apiKey, baseURL := claudeCreds(auth)
+	apiKey, baseURL := claudeCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://api.anthropic.com"
 	}
@@ -675,7 +675,7 @@ func validateClaudeStreamingResponse(data []byte) error {
 func (e *ClaudeExecutor) CountTokens(ctx context.Context, auth *cliproxyauth.Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error) {
 	baseModel := thinking.ParseSuffix(req.Model).ModelName
 
-	apiKey, baseURL := claudeCreds(auth)
+	apiKey, baseURL := claudeCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://api.anthropic.com"
 	}
@@ -1135,12 +1135,25 @@ func applyClaudeHeaders(r *http.Request, auth *cliproxyauth.Auth, apiKey string,
 }
 
 func claudeCreds(a *cliproxyauth.Auth) (apiKey, baseURL string) {
+	return claudeCredsWithConfig(nil, a)
+}
+
+func claudeCredsWithConfig(cfg *config.Config, a *cliproxyauth.Auth) (apiKey, baseURL string) {
 	if a == nil {
 		return "", ""
 	}
 	if a.Attributes != nil {
 		apiKey = a.Attributes["api_key"]
-		baseURL = a.Attributes["base_url"]
+		baseURL = strings.TrimSpace(a.Attributes["base_url"])
+	}
+	if baseURL == "" && a.AuthKind() == cliproxyauth.AuthKindOAuth && a.Metadata != nil {
+		baseURL = cliproxyauth.BaseURLFromMetadata(a.Metadata)
+	}
+	if baseURL == "" && a.AuthKind() == cliproxyauth.AuthKindOAuth && cfg != nil {
+		baseURL = strings.TrimSpace(cfg.ClaudeBaseURL)
+	}
+	if baseURL != "" {
+		baseURL = normalizeClaudeBaseURL(baseURL)
 	}
 	if apiKey == "" && a.Metadata != nil {
 		if v, ok := a.Metadata["access_token"].(string); ok {

internal/runtime/executor/claude_executor_test.go

@@ -2887,3 +2887,82 @@ func TestRestoreClaudeOAuthToolNamesFromStreamLine_MixedCaseWithPrefix(t *testin
 		t.Fatalf("Glob should be restored to glob, got: %s", string(out))
 	}
 }
+
+func TestClaudeCredsUsesGlobalBaseURLWhenAuthHasNoBaseURL(t *testing.T) {
+	apiKey, baseURL := claudeCredsWithConfig(&config.Config{ClaudeBaseURL: "http://127.0.0.1:18081"}, &cliproxyauth.Auth{
+		Metadata: map[string]any{"access_token": "oauth-token"},
+	})
+	if apiKey != "oauth-token" {
+		t.Fatalf("apiKey = %q, want oauth-token", apiKey)
+	}
+	if baseURL != "http://127.0.0.1:18081" {
+		t.Fatalf("baseURL = %q, want global override", baseURL)
+	}
+}
+
+func TestClaudeCredsAuthBaseURLPrecedesGlobalBaseURL(t *testing.T) {
+	_, baseURL := claudeCredsWithConfig(&config.Config{ClaudeBaseURL: "http://127.0.0.1:18081"}, &cliproxyauth.Auth{
+		Attributes: map[string]string{"base_url": "http://127.0.0.1:18101"},
+		Metadata:   map[string]any{"access_token": "oauth-token"},
+	})
+	if baseURL != "http://127.0.0.1:18101" {
+		t.Fatalf("baseURL = %q, want auth override", baseURL)
+	}
+}
+
+func TestClaudeCredsMetadataBaseURLPrecedesGlobalBaseURL(t *testing.T) {
+	_, baseURL := claudeCredsWithConfig(&config.Config{ClaudeBaseURL: "http://127.0.0.1:18081"}, &cliproxyauth.Auth{
+		Metadata: map[string]any{"access_token": "oauth-token", "base-url": "http://127.0.0.1:18103/"},
+	})
+	if baseURL != "http://127.0.0.1:18103" {
+		t.Fatalf("baseURL = %q, want metadata override", baseURL)
+	}
+}
+
+func TestClaudeCredsDoesNotApplyGlobalBaseURLToAPIKeyAuth(t *testing.T) {
+	_, baseURL := claudeCredsWithConfig(&config.Config{ClaudeBaseURL: "http://127.0.0.1:18081"}, &cliproxyauth.Auth{
+		Attributes: map[string]string{"api_key": "sk-ant-test"},
+	})
+	if baseURL != "" {
+		t.Fatalf("baseURL = %q, want empty for API-key auth without per-key base_url", baseURL)
+	}
+}
+
+func TestClaudeCredsTrimsTrailingSlashFromBaseURLOverrides(t *testing.T) {
+	_, authBaseURL := claudeCredsWithConfig(&config.Config{ClaudeBaseURL: "http://127.0.0.1:18081/"}, &cliproxyauth.Auth{
+		Attributes: map[string]string{"base_url": "http://127.0.0.1:18101/"},
+		Metadata:   map[string]any{"access_token": "oauth-token"},
+	})
+	if authBaseURL != "http://127.0.0.1:18101" {
+		t.Fatalf("auth baseURL = %q, want trimmed trailing slash", authBaseURL)
+	}
+
+	_, globalBaseURL := claudeCredsWithConfig(&config.Config{ClaudeBaseURL: "http://127.0.0.1:18081/"}, &cliproxyauth.Auth{
+		Metadata: map[string]any{"access_token": "oauth-token"},
+	})
+	if globalBaseURL != "http://127.0.0.1:18081" {
+		t.Fatalf("global baseURL = %q, want trimmed trailing slash", globalBaseURL)
+	}
+}
+
+func TestResolveClaudeKeyConfigNormalizesTrailingSlashForBaseURLMatch(t *testing.T) {
+	cfg := &config.Config{
+		ClaudeKey: []config.ClaudeKey{{
+			APIKey:  "key-123",
+			BaseURL: "http://127.0.0.1:18101/",
+			Cloak:   &config.CloakConfig{Mode: "always"},
+		}},
+	}
+	auth := &cliproxyauth.Auth{Attributes: map[string]string{
+		"api_key":  "key-123",
+		"base_url": "http://127.0.0.1:18101/",
+	}}
+
+	cloakCfg := resolveClaudeKeyCloakConfig(cfg, auth)
+	if cloakCfg == nil {
+		t.Fatal("expected trailing-slash base URL to match Claude key config")
+	}
+	if cloakCfg.Mode != "always" {
+		t.Fatalf("cloak mode = %q, want always", cloakCfg.Mode)
+	}
+}

internal/runtime/executor/claude_signing.go

@@ -53,7 +53,7 @@ func resolveClaudeKeyConfig(cfg *config.Config, auth *cliproxyauth.Auth) *config
 	for i := range cfg.ClaudeKey {
 		entry := &cfg.ClaudeKey[i]
 		cfgKey := strings.TrimSpace(entry.APIKey)
-		cfgBase := strings.TrimSpace(entry.BaseURL)
+		cfgBase := normalizeClaudeBaseURL(entry.BaseURL)
 		if !strings.EqualFold(cfgKey, apiKey) {
 			continue
 		}
@@ -66,6 +66,10 @@ func resolveClaudeKeyConfig(cfg *config.Config, auth *cliproxyauth.Auth) *config
 	return nil
 }
 
+func normalizeClaudeBaseURL(baseURL string) string {
+	return strings.TrimRight(strings.TrimSpace(baseURL), "/")
+}
+
 // resolveClaudeKeyCloakConfig finds the matching ClaudeKey config and returns its CloakConfig.
 func resolveClaudeKeyCloakConfig(cfg *config.Config, auth *cliproxyauth.Auth) *config.CloakConfig {
 	entry := resolveClaudeKeyConfig(cfg, auth)

internal/runtime/executor/codex_executor.go

@@ -710,7 +710,7 @@ func (e *CodexExecutor) PrepareRequest(req *http.Request, auth *cliproxyauth.Aut
 	if req == nil {
 		return nil
 	}
-	apiKey, _ := codexCreds(auth)
+	apiKey, _ := codexCredsWithConfig(e.cfg, auth)
 	if strings.TrimSpace(apiKey) != "" {
 		req.Header.Set("Authorization", "Bearer "+apiKey)
 	}
@@ -747,7 +747,7 @@ func (e *CodexExecutor) Execute(ctx context.Context, auth *cliproxyauth.Auth, re
 	}
 	baseModel := thinking.ParseSuffix(req.Model).ModelName
 
-	apiKey, baseURL := codexCreds(auth)
+	apiKey, baseURL := codexCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://chatgpt.com/backend-api/codex"
 	}
@@ -927,7 +927,7 @@ func (e *CodexExecutor) Execute(ctx context.Context, auth *cliproxyauth.Auth, re
 func (e *CodexExecutor) executeCompact(ctx context.Context, auth *cliproxyauth.Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (resp cliproxyexecutor.Response, err error) {
 	baseModel := thinking.ParseSuffix(req.Model).ModelName
 
-	apiKey, baseURL := codexCreds(auth)
+	apiKey, baseURL := codexCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://chatgpt.com/backend-api/codex"
 	}
@@ -1034,7 +1034,7 @@ func (e *CodexExecutor) ExecuteStream(ctx context.Context, auth *cliproxyauth.Au
 	}
 	baseModel := thinking.ParseSuffix(req.Model).ModelName
 
-	apiKey, baseURL := codexCreds(auth)
+	apiKey, baseURL := codexCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://chatgpt.com/backend-api/codex"
 	}
@@ -1853,12 +1853,22 @@ func parseCodexRetryAfter(statusCode int, errorBody []byte, now time.Time) *time
 }
 
 func codexCreds(a *cliproxyauth.Auth) (apiKey, baseURL string) {
+	return codexCredsWithConfig(nil, a)
+}
+
+func codexCredsWithConfig(cfg *config.Config, a *cliproxyauth.Auth) (apiKey, baseURL string) {
 	if a == nil {
 		return "", ""
 	}
 	if a.Attributes != nil {
 		apiKey = a.Attributes["api_key"]
-		baseURL = a.Attributes["base_url"]
+		baseURL = strings.TrimSpace(a.Attributes["base_url"])
+	}
+	if baseURL == "" && a.AuthKind() == cliproxyauth.AuthKindOAuth && a.Metadata != nil {
+		baseURL = cliproxyauth.BaseURLFromMetadata(a.Metadata)
+	}
+	if baseURL == "" && a.AuthKind() == cliproxyauth.AuthKindOAuth && cfg != nil {
+		baseURL = strings.TrimSpace(cfg.CodexBaseURL)
 	}
 	if apiKey == "" && a.Metadata != nil {
 		if v, ok := a.Metadata["access_token"].(string); ok {

internal/runtime/executor/codex_oauth_base_url_test.go

@@ -0,0 +1,48 @@
+package executor
+
+import (
+	"testing"
+
+	"github.com/router-for-me/CLIProxyAPI/v7/internal/config"
+	cliproxyauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"
+)
+
+func TestCodexCredsUsesGlobalBaseURLWhenAuthHasNoBaseURL(t *testing.T) {
+	apiKey, baseURL := codexCredsWithConfig(&config.Config{CodexBaseURL: "http://127.0.0.1:18082"}, &cliproxyauth.Auth{
+		Metadata: map[string]any{"access_token": "oauth-token"},
+	})
+	if apiKey != "oauth-token" {
+		t.Fatalf("apiKey = %q, want oauth-token", apiKey)
+	}
+	if baseURL != "http://127.0.0.1:18082" {
+		t.Fatalf("baseURL = %q, want global override", baseURL)
+	}
+}
+
+func TestCodexCredsAuthBaseURLPrecedesGlobalBaseURL(t *testing.T) {
+	_, baseURL := codexCredsWithConfig(&config.Config{CodexBaseURL: "http://127.0.0.1:18082"}, &cliproxyauth.Auth{
+		Attributes: map[string]string{"base_url": "http://127.0.0.1:18102"},
+		Metadata:   map[string]any{"access_token": "oauth-token"},
+	})
+	if baseURL != "http://127.0.0.1:18102" {
+		t.Fatalf("baseURL = %q, want auth override", baseURL)
+	}
+}
+
+func TestCodexCredsMetadataBaseURLPrecedesGlobalBaseURL(t *testing.T) {
+	_, baseURL := codexCredsWithConfig(&config.Config{CodexBaseURL: "http://127.0.0.1:18082"}, &cliproxyauth.Auth{
+		Metadata: map[string]any{"access_token": "oauth-token", "base_url": "http://127.0.0.1:18104"},
+	})
+	if baseURL != "http://127.0.0.1:18104" {
+		t.Fatalf("baseURL = %q, want metadata override", baseURL)
+	}
+}
+
+func TestCodexCredsDoesNotApplyGlobalBaseURLToAPIKeyAuth(t *testing.T) {
+	_, baseURL := codexCredsWithConfig(&config.Config{CodexBaseURL: "http://127.0.0.1:18082"}, &cliproxyauth.Auth{
+		Attributes: map[string]string{"api_key": "sk-codex-test"},
+	})
+	if baseURL != "" {
+		t.Fatalf("baseURL = %q, want empty for API-key auth without per-key base_url", baseURL)
+	}
+}

internal/runtime/executor/codex_openai_images.go

@@ -91,7 +91,7 @@ func (e *CodexExecutor) executeOpenAIImage(ctx context.Context, auth *cliproxyau
 		return resp, errPrepare
 	}
 
-	apiKey, baseURL := codexCreds(auth)
+	apiKey, baseURL := codexCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://chatgpt.com/backend-api/codex"
 	}
@@ -187,7 +187,7 @@ func (e *CodexExecutor) executeOpenAIImageStream(ctx context.Context, auth *clip
 		return nil, errPrepare
 	}
 
-	apiKey, baseURL := codexCreds(auth)
+	apiKey, baseURL := codexCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://chatgpt.com/backend-api/codex"
 	}
@@ -319,7 +319,7 @@ func (e *CodexExecutor) executeDirectOpenAIImage(ctx context.Context, auth *clip
 		return resp, errPrepare
 	}
 
-	apiKey, baseURL := codexCreds(auth)
+	apiKey, baseURL := codexCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://chatgpt.com/backend-api/codex"
 	}
@@ -379,7 +379,7 @@ func (e *CodexExecutor) executeDirectOpenAIImageStream(ctx context.Context, auth
 		return nil, errPrepare
 	}
 
-	apiKey, baseURL := codexCreds(auth)
+	apiKey, baseURL := codexCredsWithConfig(e.cfg, auth)
 	if baseURL == "" {
 		baseURL = "https://chatgpt.com/backend-api/codex"
 	}

internal/runtime/executor/codex_openai_images_test.go

@@ -315,3 +315,26 @@ func TestCodexExecutorDirectOpenAIImageEditUsesImagesEditEndpointForMultipart(t
 		t.Fatalf("mask.image_url = %q, want mask-data data URL; body=%s", maskURL, string(gotBody))
 	}
 }
+
+func TestCodexExecutorDirectOpenAIImageGenerationUsesGlobalBaseURLForOAuthAuth(t *testing.T) {
+	var gotPath string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"created":1713833628,"data":[{"b64_json":"AA=="}],"usage":{"total_tokens":1,"input_tokens":1,"output_tokens":0}}`))
+	}))
+	defer server.Close()
+
+	executor := NewCodexExecutor(&config.Config{CodexBaseURL: server.URL})
+	auth := &cliproxyauth.Auth{Provider: "codex", Metadata: map[string]any{"access_token": "oauth-token"}}
+	_, errExecute := executor.Execute(context.Background(), auth, cliproxyexecutor.Request{
+		Model:   "codex/gpt-image-1.5",
+		Payload: []byte(`{"model":"codex/gpt-image-1.5","prompt":"draw","stream":false}`),
+	}, codexOpenAIImageTestOptions(codexImagesGenerationsPath, false))
+	if errExecute != nil {
+		t.Fatalf("Execute() error = %v", errExecute)
+	}
+	if gotPath != "/images/generations" {
+		t.Fatalf("path = %q, want /images/generations", gotPath)
+	}
+}