Repository navigation
OAuth tokens too long for Windows keyring #10353
Description
What version of Codex is running?
0.93.0
What subscription do you have?
Plus
Which model were you using?
No response
What platform is your computer?
Windows 11
What terminal emulator and version are you using (if applicable)?
Windows Terminal
What issue are you seeing?
The primary login mechanism via OAuth doesn't work on Windows when using the keyring storage option.
Unable to persist auth file: failed to write OAuth tokens to keyring: Attribute 'password encoded as UTF-16' is longer than platform limit of 2560 chars
What steps can reproduce the bug?
Log in with the following configuration:
cli_auth_credentials_store = "keyring"
mcp_oauth_credentials_store = "keyring"What is the expected behavior?
No response
Additional information
No response
Activity
etraut-openai commentedon Feb 2, 2026
Thanks for reporting. The keyring feature isn't supported on Windows currently. I'm going to change this from a bug report to a feature request. In the meantime, I'll make it clearer in our documentation, and we'll work on getting a better error message in place.
[-]OAuth tokens too long for Windows keyring[/-][+]Support keyring auth storage on Windows[/+]etraut-openai commentedon Feb 2, 2026
Oh, I take that back. I just heard back from the Codex team member who implemented the keyring support, and she confirmed that this should work on Windows. So it sounds like this is a bug. She'll investigate.
[-]Support keyring auth storage on Windows[/-][+]OAuth tokens too long for Windows keyring[/-] [+]Support keyring auth storage on Windows[/+][-]OAuth tokens too long for Windows keyring[/-] [+]Support keyring auth storage on Windows[/-][+]OAuth tokens too long for Windows keyring[/+]Ashutosh0x commentedon Feb 4, 2026
Hi @celia-oai @etraut-openai, I'm a developer interested in contributing! I saw this report about OAuth tokens exceeding the 2560-character limit in Windows Credential Manager. Since I'm on Windows, I'd like to work on a fix involving token chunking for the keyring store. Does that approach sound good to you?
fix(keyring): implement token chunking for Windows keyring length limit
Ashutosh0x commentedon Feb 4, 2026
Hey! I've been looking into the
TooLongerrors on Windows and wanted to share the root cause and a potential path forward.Root Cause
On Windows, the Credential Manager (which the
keyringcrate uses) has a hard limit on the length of the secret (the "password" field). This limit is roughly 2560 bytes (which equates to 1280 UTF-16 characters).As OAuth tokens grow (especially with larger JWT payloads or session data), they are hitting this system-level constraint, leading to the
TooLongerror during login.Proposed Fix: Token Chunking
The most reliable way to handle this without changing the storage backend is to implement transparent chunking in the
keyring-store.When a value exceeds a safe threshold (e.g., 2048 bytes):
CODEX_CHUNKED:N:<checksum>) whereNis the number of chunks.account:1,account:2, ...).Implementation Logic
CODEX_CHUNKEDheader. If present, load all auxiliary keys, verify integrity (e.g., via checksum or just length), and reassemble.Verification
I've tested this logic locally with tokens up to 10,000 characters. It successfully bypasses the Windows Credential Manager limits while maintaining compatibility with the existing
keyringAPI used by Codex.I had a draft implementation ready, but since the guidelines are now invitation-only, I'm sharing the analysis here first. Happy to help more if the team wants to pursue this approach!
fix(keyring): increase chunk size to prevent Windows credential limit…
fix(keyring): implement token chunking for Windows keyring length limit
fix(keyring): increase chunk size to prevent Windows credential limit…
Ashutosh0x commentedon Feb 11, 2026
Following up on the discussion in PR #10732, I'm moving the technical analysis for the proposed fix for this issue here as requested by @etraut-openai.
Technical Analysis for #10353
What?
Implement transparent token chunking for the Windows keyring to bypass the hard 2560-byte limit of the Windows Credential Manager.
Why?
Modern OAuth tokens often exceed the Windows limit. Without chunking, authentication fails silently for Windows users, creating a major platform disparity.
How?
token,token:1).CODEX_CHUNKED:header to automatically reconstruct the full token during load operations.I have verified this implementation with tokens up to 5000 chars on Windows 11. If this fits the team's intended approach for solving this, I'd value an invitation to move this forward.
celia-oai commentedon Jun 12, 2026
this is closed by the PR stack ending in #27541.
ofek commentedon Jun 12, 2026
Thank you!