Skip to content

[VS Code Extension] Requires re-login on every restart — JWT missing chatgpt_plan_type on ARM64 Windows #13007

Closed
Closed
[VS Code Extension] Requires re-login on every restart — JWT missing chatgpt_plan_type on ARM64 Windows#13007
Labels
authIssues related to authentication and accountsbugSomething isn't workingextensionIssues related to the VS Code extensionwindows-osIssues related to Codex on Windows systems

Description

@Leilight
Leilight
opened on Feb 27, 2026

Description

The Codex VS Code extension requires re-login to OpenAI (ChatGPT Plus) account on every VS Code restart, and even when opening the Codex settings panel. This happens consistently on Windows 11 ARM64.

Root Cause Analysis

After debugging, I found the root cause in the extension source code (extension.js):

The "account-info" handler extracts chatgpt_account_id, chatgpt_user_id, and chatgpt_plan_type from the JWT token's https://api.openai.com/auth claim:

n = r["https://api.openai.com/auth"] ?? {}
i = n?.chatgpt_account_id ?? null    // → null
s = n?.chatgpt_user_id ?? null       // → null
a = n?.chatgpt_plan_type ?? null     // → null
c = o.email ?? null                  // → "xxx@live.com" ✓
if (i && s && a) return { accountId: i, userId: s, plan: a, email: c }
// Falls through → returns all nulls → triggers re-login

However, the JWT's https://api.openai.com/auth claim only contains:

{
  "groups": [],
  "organizations": [{ "id": "org-xxx", "is_default": true, "role": "owner", "title": "Personal" }],
  "user_id": "user-xxx"
}

The chatgpt_account_id, chatgpt_user_id, and chatgpt_plan_type fields are completely absent from the JWT — both in the initial token and after refresh. This causes the extension to always return {accountId: null, userId: null, plan: null, email: null}, which triggers the account/read error:

error={"code":-32600,"message":"email and plan type are required for chatgpt authentication"}

Expected Behavior

The extension should either:

  1. Include chatgpt_plan_type, chatgpt_account_id, chatgpt_user_id in the JWT token returned during authentication/refresh, OR
  2. Fall back to fetching account info from the OpenAI API when these claims are missing from the JWT, OR
  3. Use user_id (which IS present in the JWT) as a fallback for chatgpt_user_id

Workaround

Patching extension.js to use fallback values when the ChatGPT-specific JWT claims are missing:

// Before (original):
i=n?.chatgpt_account_id??null,s=n?.chatgpt_user_id??null,a=n?.chatgpt_plan_type??null,c=o.email??null;
if(i&&s&&a)return{accountId:i,userId:s,plan:a,email:c}

// After (patched):
i=n?.chatgpt_account_id??null,s=n?.chatgpt_user_id??n?.user_id??null,a=n?.chatgpt_plan_type??"plus",c=o.email??null;
if(s&&c)return{accountId:i??s,userId:s,plan:a,email:c}

Environment

  • OS: Windows 11 Pro ARM64 (10.0.26200)
  • VS Code: Latest
  • Codex Extension Version: 0.4.78 (also reproduced on 0.4.76)
  • Architecture: ARM64 (aarch64)
  • Account type: ChatGPT Plus (password login, not SSO)
  • Auth mode: chatgpt (in ~/.codex/auth.json)

Steps to Reproduce

  1. Install Codex VS Code extension on Windows 11 ARM64
  2. Sign in with ChatGPT Plus account
  3. Close and reopen VS Code
  4. Codex extension requires re-login
  5. Check ~/.codex/auth.json — tokens exist, account_id is null
  6. Decode the JWT id_token — chatgpt_plan_type, chatgpt_account_id, chatgpt_user_id are all missing from the https://api.openai.com/auth claim

Related Issues

Logs

2026-02-27 19:51:23.301 [error] Request failed conversationId=none durationMs=1800
error={"code":-32600,"message":"email and plan type are required for chatgpt authentication"}
method=account/read pendingCountAfter=2 timeoutMs=0

Activity

  1. github-actions
    added
    bugSomething isn't working
    extensionIssues related to the VS Code extension
    windows-osIssues related to Codex on Windows systems
    authIssues related to authentication and accounts
    on Feb 27, 2026

  2. github-actions commented on Feb 27, 2026

    @github-actions
    github-actionsBot
    on Feb 27, 2026 – with GitHub Actions
    Contributor

    Potential duplicates detected. Please review them and close your issue if it is a duplicate.

    Powered by Codex Action

  3. Leilight commented on Feb 27, 2026

    @Leilight
    Leilight
    on Feb 27, 2026
    Author

    This is related to #12170 — same symptom and same error message.

    However, this issue provides additional root cause analysis and a working patch:

    • Root cause: The JWT token's https://api.openai.com/auth claim is missing chatgpt_account_id, chatgpt_user_id, and chatgpt_plan_type fields — both on initial login and after token refresh. The extension code requires all three to be non-null, which always fails.

    • Workaround patch for extension.js is included above, which falls back to user_id and defaults plan_type to "plus" when the ChatGPT-specific claims are absent.

    This issue is not platform-specific — #12170 reports it on Linux x64, and I'm experiencing it on Windows ARM64. The underlying cause is the same: the JWT simply doesn't contain the required claims.

  4. Leilight commented on Feb 27, 2026

    @Leilight
    Leilight
    on Feb 27, 2026
    Author

    Update: This issue is NOT platform-specific.

    Reproduced on:

    This is an account-level issue, not a platform issue. The JWT returned by OpenAI's auth server simply does not include chatgpt_plan_type, chatgpt_account_id, or chatgpt_user_id claims for certain accounts. Sign-in method is password-based (not SSO/social login).

    cc @etraut-openai — per your question on #12170 about sign-in method: this account uses password authentication (auth_provider: "password" in JWT). Could this be related to why these ChatGPT-specific claims are missing from the token?

  5. Leilight commented on Feb 27, 2026

    @Leilight
    Leilight
    on Feb 27, 2026
    Author

    Important new finding:

    Tested with different login methods on the same machine:

    Login method Re-login required? Plan detected
    Password Yes, every restart N/A (JWT missing chatgpt_plan_type entirely)
    Microsoft OAuth No ✓ ❌ Detected as free (actual subscription: Pro $200/mo)

    This confirms two separate bugs:

    1. Password auth: JWT https://api.openai.com/auth claim does not include chatgpt_plan_type, chatgpt_account_id, or chatgpt_user_id — causing the account/read failure and re-login loop.

    2. Social auth (Microsoft): JWT includes chatgpt_plan_type but with incorrect value — a Pro subscriber is detected as a free user, showing "Get Plus" upgrade prompt.

    Both issues point to the same root cause: the auth server is not correctly populating ChatGPT subscription info in the JWT for this account.

  6. Leilight commented on Feb 27, 2026

    @Leilight
    Leilight
    on Feb 27, 2026
    Author

    Correction to previous comment:

    The Microsoft OAuth test was misleading — it logged into a different OpenAI account (a free one), not the Pro account. So the "wrong plan detection" part was incorrect.

    The actual issue remains only one bug:

    Password-based login does not populate chatgpt_plan_type, chatgpt_account_id, or chatgpt_user_id in the JWT's https://api.openai.com/auth claim. Social login (Microsoft/Google/Apple) does populate these fields, but that doesn't help users whose subscription is on a password-authenticated account.

    This is a server-side issue with OpenAI's auth endpoint — the Codex extension and CLI cannot work around it.

  7. etraut-openai commented on Feb 27, 2026

    @etraut-openai
    etraut-openai
    on Feb 27, 2026
    Contributor

    Which version of the extension are you using? Were you seeing this behavior with previous versions? I'm trying to determine if this was a recent regression.

  8. Leilight commented on Feb 27, 2026

    @Leilight
    Leilight
    on Feb 27, 2026
    Author

    Extension version: 0.4.78 (also previously tested with 0.4.76 — same behavior)

    This is not a recent regression — I started using the Codex VS Code extension about a month ago (late January 2026), and the issue has been present since my very first install. I have never been able to use the extension without re-logging in on every VS Code restart.

    Sign-in method: Password-based authentication (auth_provider: "password" in JWT). Auth mode is chatgpt (ChatGPT Pro subscription, not API key).

    Reproduction rate: 100%. Today's VS Code logs show 10 separate sessions, and every single one shows the account/read error immediately on startup:

    [error] Request failed error={"code":-32600,"message":"email and plan type are required for chatgpt authentication"} method=account/read

    The JWT's https://api.openai.com/auth claim consistently does not include chatgpt_plan_type, chatgpt_account_id, or chatgpt_user_id — both on initial login and after token refresh.

  9. Leilight commented on Feb 27, 2026

    @Leilight
    Leilight
    on Feb 27, 2026
    Author

    Note: The extension.js workaround patch mentioned in the original issue description does not actually resolve the problem. The account/read validation happens inside the codex.exe binary (compiled Rust code), not in extension.js. The extension.js account-info handler is a separate code path. This is a server-side issue — the fix needs to come from OpenAI's auth server populating the missing JWT claims.

  10. etraut-openai
    added a commit that references this issue on Feb 28, 2026

    Handle missing plan info for ChatGPT accounts (#13072)

    ff5cbfd

  11. etraut-openai commented on Feb 28, 2026

    @etraut-openai
    etraut-openai
    on Feb 28, 2026
    Contributor

    This will be fixed in the next release

  12. etraut-openai
    closed this as completedon Feb 28, 2026
  13. monkeycode-ai
    added a commit that references this issue on Jun 8, 2026

    Handle missing plan info for ChatGPT accounts (#13072)

    d563e59
  14. wangjiecloud
    added a commit that references this issue on Jun 27, 2026

    Handle missing plan info for ChatGPT accounts (openai#13072)

    3df2b78

  15. Leilight commented on Jul 23, 2026

    @Leilight
    Leilight
    on Jul 23, 2026
    Author

    Reporting a recurrence of this exact issue in a new surface: Codex desktop for Windows 26.715 (merged ChatGPT/Codex UI).

    My account still receives tokens without chatgpt_account_id / chatgpt_user_id / chatgpt_plan_type in the https://api.openai.com/auth claim (password and phone sign-in — re-verified today on fresh logins, in both id_token and access_token). Thanks to #13072 the core now tolerates this: codex login status reports "Logged in using ChatGPT" and everything works on my subscription.

    However, the new desktop app introduces a fresh client-side feature-access check in the webview that hard-requires those claims. With them absent it resolves to denied / missing-account, which forces the "work" UI variant, permanently hides all codex content in the sidebar ("No projects / No tasks", while Search still works), never starts local thread catalog population, and loops remote-control enrollment on -32603 waiting for a ChatGPT account id.

    Full analysis in #19290. In short: the scenario #13072 fixed for the core has been reintroduced by the desktop UI layer. Could the same "handle missing plan info" treatment be applied there — or, ideally, could the auth server start emitting these claims for password/phone accounts? cc @etraut-openai

  16. shafqatevo
    added a commit that references this issue on Aug 7, 2026

    Handle missing plan info for ChatGPT accounts (#13072)

    ee56caa
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    authIssues related to authentication and accountsbugSomething isn't workingextensionIssues related to the VS Code extensionwindows-osIssues related to Codex on Windows systems

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions