A Swiss Army knife for ChatGPT session smuggling
Browser-side converter that turns a ChatGPT web login session into importable auth JSON for seven different API proxy tools.

What it does
You paste or drop a ChatGPT web session JSON into a single-page browser app, pick a target format, and get back ready-to-import auth credentials. It supports seven downstream tools: CPA, sub2api, Cockpit, 9router, Codex, AxonHub, and Codex-Manager. All parsing and conversion happens locally; nothing is uploaded or stored.
The interesting bit
The tool solves a specific friction: ChatGPT web sessions don’t include OAuth refresh_tokens, so standard Codex OAuth flows that demand phone binding break. By extracting accessToken from the web session and, when needed, fabricating placeholder JWT claims for missing id_tokens, it lets Plus subscribers sidestep that gate and feed their session into proxy infrastructure anyway. The README is unusually candid about the “撸羊毛” (wool-pulling) economics driving this.
Key highlights
- Accepts five input formats: ChatGPT web session, 9router OAuth, native Codex
auth.json, AxonHubauth.json, and Codex-Manager batch JSON - Derives missing metadata (email, account ID, plan type, expiry) by decoding the JWT payload of
accessToken - Outputs are tailored per target: CPA gets synthetic
id_tokenclaims; sub2api getsauto_pause_on_expired; AxonHub gets__missing_refresh_token__as an explicit placeholder - Pure static HTML/JS; works offline by opening
docs/index.html - Explicitly Plus-only: Free-tier
access_tokens lack model-calling permissions, and the tool won’t change that
Caveats
- No
refresh_tokenmeans access tokens expire and die; automatic renewal is impossible with web-session-derived credentials - The README warns that Free accounts are useless here, and the Discord pitch for “free GPT羊毛 info” suggests the surrounding ecosystem is volatile
Verdict
Worth bookmarking if you operate or resell through CPA/sub2api/Codex-style proxies and need to onboard ChatGPT Plus sessions without OAuth gymnastics. Skip it if you’re a standard API user with normal key access — this is infrastructure glue for a specific gray-market pipeline.