ChatGPT.app Codex relay returns 403 'invalid or disabled credential' after v26.715.31925 update #33969

Summary

Codex inside ChatGPT Desktop App returns HTTP 403 "invalid or disabled credential" from the relay endpoint after updating to version 26.715.31925. The app shows "Reconnecting... 5/5" and never generates a response.

Environment

• App: ChatGPT Desktop App for macOS
• App version: 26.715.31925 (CFBundleVersion 5551)
• Codex Framework: 150.0.7871.124
• OS: macOS 26.5.2 (arm64)
• Auth mode: ChatGPT OAuth (auth_mode: chatgpt)
• Account: ChatGPT Pro
• ChatGPT web: works normally

Steps to reproduce

1. Open ChatGPT.app (version 26.715.31925) on macOS.
2. Switch to Codex mode or start a code-related conversation.
3. Send any message.
4. Observe the error bubble: "Reconnecting... 5/5" followed by the 403 error.

Expected behavior

Codex should process the request and generate a response using the ChatGPT OAuth session, the same way ChatGPT web conversations work.

Actual behavior

The relay endpoint https://chat-response.codex-openai.com/relay/responses returns:

unexpected status 403 Forbidden: {"error":"invalid or disabled credential"}

The app retries 5 times then shows the error. No response is generated.

Additional context

Config

The auto-generated ~/.codex/config.toml configures:

[model_providers.OpenAI]
name = "OpenAI"
base_url = "https://chat-response.codex-openai.com/relay"
wire_api = "responses"
requires_openai_auth = true

Auth

~/.codex/auth.json reports:

• auth_mode: chatgpt (ChatGPT OAuth)
• OPENAI_API_KEY: [not set]
• ChatGPT tokens present (id_token, access_token, refresh_token)
• Last refreshed: 2026-07-18T07:21:47Z (after app update)

Network diagnostics

• Domain chat-response.codex-openai.com resolves, SSL certificate is valid.
• Endpoint responds 401 without auth headers (expected).
• Domain is reachable both through proxy and direct connection.
• chatgpt.com/backend-api works for web conversations.

What was tried

1. codex logout + codex login — CLI re-auth succeeds, Desktop relay still fails.
2. Full ChatGPT.app restart.
3. Delete ~/.codex/auth.json + cookies + re-login via app.
4. Complete reinstall of ChatGPT.app.
5. codex login --device-auth.
6. Proxy on/off — no change.

Suspected cause

The new Codex framework v150.0.7871.124 introduces chat-response.codex-openai.com/relay as the API base URL, replacing the previous chatgpt.com/backend-api/codex/responses path. The relay has requires_openai_auth = true but the active auth mode is chatgpt (ChatGPT OAuth). The relay endpoint appears to reject ChatGPT OAuth tokens — it recognizes the token format (returns 403, not 401) but marks the credential as "invalid or disabled". The official app-server README states that chatgpt (ChatGPT managed OAuth) is the recommended auth mode, suggesting the relay should accept ChatGPT OAuth tokens.

Related issues

• Unexpected 403 forbidden error #9271 similar 403 from chatgpt.com/backend-api/codex/responses
• 403 forbidden error. #18681 403 during Codex service outage
• gpt-5.6-sol/terra/luna hardcode use_responses_lite / multi_agent_version, causing 400s on Azure (and likely any non-ChatGPT-backend) model_provider #31882 Responses-Lite and auth mismatch for non-default providers