Merge pull request #5337 from wucm667/fix/issue-5331-oauth-count-tokens-fallback

fix: avoid cooling OAuth accounts for HTML count token errors

backend/internal/service/openai_gateway_count_tokens.go

@@ -345,12 +345,26 @@ func isOpenAIOAuthInputTokensUnsupported(statusCode int, body []byte) bool {
 		return true
 	}
 
+	// OAuth's platform endpoint can be blocked by an upstream proxy before it
+	// reaches the API and return an HTML 403 page without a structured error.
+	// Treat that endpoint-level response like the other unsupported cases so
+	// count_tokens remains a local, non-health-affecting convenience request.
+	if statusCode == http.StatusForbidden && isHTMLResponse(body) {
+		return true
+	}
+
 	return strings.Contains(msg, "input_tokens") &&
 		(strings.Contains(msg, "not found") ||
 			strings.Contains(msg, "not supported") ||
 			strings.Contains(msg, "unsupported"))
 }
 
+func isHTMLResponse(body []byte) bool {
+	trimmed := strings.TrimSpace(strings.ToLower(string(body)))
+	return strings.HasPrefix(trimmed, "<!doctype html") ||
+		strings.HasPrefix(trimmed, "<html")
+}
+
 func estimateOpenAIInputTokens(req openAIInputTokensCountRequest) (int, error) {
 	codec, err := openAIInputTokensCodecForModel(req.Model)
 	if err != nil {

backend/internal/service/openai_gateway_count_tokens_test.go

@@ -123,6 +123,11 @@ func TestOpenAIGatewayService_ForwardCountTokensAsAnthropic_OAuthFallsBackWhenPl
 			statusCode: http.StatusForbidden,
 			body:       `{"error":{"type":"invalid_request_error","code":"missing_scope","message":"Missing scopes: api.responses.write"}}`,
 		},
+		{
+			name:       "403_html_proxy_page",
+			statusCode: http.StatusForbidden,
+			body:       "<!doctype html><html><body>Forbidden</body></html>",
+		},
 		{
 			name:       "404_input_tokens_unsupported",
 			statusCode: http.StatusNotFound,