The error means the Codex client you are running cannot call the ‘gpt-6-astra’ model through a ChatGPT account login. ChatGPT account authentication exposes only the model routes OpenAI has enabled for that account tier and client, and a custom or unreleased model identifier is rejected before any request reaches a model. The fix is to use a supported Codex model or switch to API-key authentication with access to that model.
The routing layer that rejects your model name
Codex is a client, not a model host. When you sign in with a ChatGPT account, the client sends your request to an OpenAI endpoint that checks three things in sequence: who you are, what your account is entitled to, and whether the requested model identifier exists on the route you are using. The rejection happens at the third check, which is why the message names the model rather than your account.
The identifier “gpt-6-astra” does not appear in the model list that ChatGPT account routes advertise. Model names are exact strings, not fuzzy matches. A near-miss like a wrong version suffix, an internal codename, or a preview alias fails the same way a completely invented name does. The server does not attempt a fallback to a similar model, because silent substitution would make outputs non-reproducible.
Authentication mode changes the catalog you see. ChatGPT account sessions are scoped to consumer or workspace entitlements. API keys are scoped to organization-level model access. A model that exists behind one path can be invisible behind the other, and the error text is identical either way.
Plain language: the door is real, your key fits, but the room number you asked for is not on this floor.
Where the failure sits in the request path
The check order matters for diagnosis. Identity verification happens first and produces a different error class if it fails. Entitlement checks come second and typically return a permissions or plan message. Model resolution comes third, after the session is already authenticated, which is why you can be fully signed in and still see a model error.
Client-side model pickers can mask this. If you typed the model name into a config file or passed it as a flag, the client may send it without validation. The client trusts your string and lets the server decide. That design keeps clients forward-compatible with new models, but it also means typos survive until runtime.
Caching adds a second failure window. Model catalogs are fetched and cached by the client, often with a TTL measured in minutes to hours. A model enabled on your account can still fail for the remainder of a stale cache window. Restarting the client forces a fresh catalog fetch and is a legitimate first diagnostic step, not a superstition.
Counterintuitively, the error is more common on correctly configured accounts than on misconfigured ones. Well-configured users read release notes, copy model names from documentation, and try them before their account tier or client version has caught up. The configuration is right; the timing is wrong.
Quantified context: models, versions, and windows
Model identifiers carry structured meaning. A family name, a version number, and a variant suffix each map to separate access rules. Changing any segment can move the request to a different entitlement check. Treat the full string as atomic.
Rollout lag between announcement and general availability commonly runs from days to several weeks for account-gated features. During that window, documentation and reality diverge, and users who read announcements first hit the error first. There is no published SLA for how fast a given account tier sees a new identifier.
Client versions matter at the margins. Older Codex builds may lack the catalog entries or request schema fields that newer routes expect, producing model-not-supported errors even when the account is entitled. Updating the client resolves a meaningful share of these cases and costs nothing to try.
Rate and quota limits produce different messages. A quota error names usage or limits, not the model. If your error text explicitly says the model is not supported, you are almost certainly in the resolution stage, not the quota stage. That distinction saves hours of pointless billing checks.
Comparison of access paths
| Access path | Model catalog scope | Typical failure mode | Auth artifact | Best fit |
|---|---|---|---|---|
| ChatGPT account session | Tier and workspace entitlements | Model not supported | Browser or device login | Standard supported models |
| API key, project-scoped | Organization model grants | 403 or model-not-found | Secret key in env | Automation and custom models |
| Enterprise workspace | Admin-assigned model access | Policy denial | SSO plus workspace | Governed team deployments |
| Local or self-hosted runtime | Whatever weights you load | Load or memory error | Local config only | Offline and private work |
| Third-party gateway | Gateway’s proxied catalog | Gateway-specific 4xx | Gateway key | Multi-provider routing |
| Preview or waitlist access | Invitation-scoped models | Not supported until granted | Flag on account | Early evaluation |
The table’s practical reading: match the auth artifact to the catalog that contains your model. If the model lives behind an API key grant, no amount of ChatGPT re-login will surface it.
Red flags in your own setup
The model string was copied from a forum post, screenshot, or social thread rather than official documentation. Your client version predates the model’s announced availability. You switched authentication modes without restarting the client or clearing cached catalogs. The same model name works for a colleague on a different account tier or workspace role. You are passing the model via an environment variable that a wrapper script silently overrides.
Each flag points to a different layer. Flags one and two are resolution and version problems. Flags three and five are configuration drift. Flag four is the cleanest signal that entitlement, not syntax, is the blocker.
Edge cases that mimic a model problem
Proxy and gateway layers rewrite model names. A corporate proxy or third-party router may map your requested identifier to an internal alias, and the alias may not exist upstream. The error surfaces as model-not-supported even though your client sent a valid name. Bypassing the proxy once isolates this quickly.
Workspace policy can restrict model families independently of billing. An admin allowlist that omits a family produces the same rejection text as a nonexistent model. Check admin console model policies before assuming the identifier is wrong.
Regional and contractual restrictions exist for some routes. Availability can vary by data residency commitments or contract terms, and the failure looks identical to a naming error. These cases are rare but real, and they require support contact rather than configuration changes.
Deprecation is the mirror image. A model that worked last quarter can be retired on a published schedule, after which requests fail with resolution errors. If the model name is old rather than new, check retirement notices before debugging your setup.
Misconceptions worth discarding
“Signing out and back in fixes model errors.” Re-authentication refreshes identity, not entitlements or catalogs. It occasionally helps because it forces a client restart, which is the actual fix.
“The model exists, so the error is a bug.” Existence in a blog post is not existence on your route. Model availability is per-route, per-tier, and per-time. The error is usually accurate.
“Any ChatGPT plan unlocks any model.” Tiers gate model families and variants independently. A higher tier does not guarantee access to every identifier, especially unreleased or preview names.
“API access and ChatGPT access are interchangeable.” They are separate products with separate catalogs and separate billing. The overlap is partial and changes over time.
“Retrying will eventually succeed.” Resolution failures are deterministic for a given account, client, and identifier. Retries burn time; changing one variable is faster.
Practical actions, in order
Copy the model identifier from official documentation for your exact client and auth mode. Compare character by character, including suffixes. Update the Codex client to the current release, then fully restart it to force a catalog refresh. Run the client’s model listing command or open the model picker. If your model is absent from the list, the route does not offer it. If the model is API-only, switch to API-key authentication with a key whose organization has the model granted, and set the key in the environment rather than a wrapper script. Test with a known-supported model on the same route. Success there proves the route and auth work and isolates the failure to model resolution. If the model should be entitled, open a support request with the exact error text, client version, auth mode, and timestamp. Support can see grants your client cannot.
Threshold guidance: if two of the red flags above apply, stop debugging the model name and audit configuration first. If a known-supported model also fails, the problem is auth or route, not the identifier.
Limits of what this explains
This article explains the mechanism of model resolution failures and the diagnostic order that isolates them. It cannot tell you which models your specific account is entitled to, because those grants are account-specific and change without public notice. It also cannot confirm whether “gpt-6-astra” exists, is planned, or is a codename, since no authoritative public model catalog entry was available to verify at the time of writing. Any specific model name, version number, or rollout date should be confirmed against official OpenAI documentation for your client and authentication mode before you change configuration. Where this article gives no price or date, that reflects the absence of verifiable current evidence, not an omission.