Windows Desktop hangs after successful OAuth and incorrectly reports "Your access token could not be refreshed because your refresh token was revoked #35673

Activity

1. herssede

   added

   appIssues related to the Codex desktop appIssues related to the Codex desktop app

   on Jul 27, 2026
2. github-actions

   added

   bugSomething isn't workingSomething isn't working

   windows-osIssues related to Codex on Windows systemsIssues related to Codex on Windows systems

   authIssues related to authentication and accountsIssues related to authentication and accounts

   on Jul 27, 2026
3. moo-go-blind commented on Aug 20, 2026

   

   moo-go-blind

   on Aug 20, 2026 – with ChatGPT Codex Connector

   More actions

   I am seeing what appears to be the same issue on a newer Windows Codex Desktop build, and I was able to capture the authentication sequence in logs_2.sqlite.

   Environment

   • Windows 11 x64
   • Codex Desktop package: OpenAI.Codex 26.818.2441.0
   • Desktop client reported in app-server logs: 26.818.21641
   • Codex CLI: v0.148.0
   • ChatGPT Plus
   • Codex CLI authentication works normally with the same account

   Symptom

   Codex Desktop can authenticate successfully and can start a new thread normally.

   For example:

   1. Sign in to Codex Desktop with ChatGPT.
   2. Create a fresh thread.
   3. Send 1+1?.
   4. The model responds normally with 2.
   5. Shortly after the turn completes, the Desktop app switches back to the Sign in to ChatGPT screen.

   This is reproducible even with a completely new thread and a trivial prompt.

   Codex CLI does not reproduce the problem. I tested multiple consecutive turns in CLI successfully.

   Authentication logs

   The Desktop app calls getAuthStatus, reloads the current auth state successfully, and then attempts to refresh the token:

   Reloading auth for account ...
   Reloaded auth, changed: false
   Refreshing token
   

   The request to:

   POST https://auth.openai.com/oauth/token
   

   then returns:

   401 Unauthorized
   

   and the Codex auth manager logs:

   Failed to refresh token: 401 Unauthorized
   
   {
     "error": {
       "message": "Your refresh token has been invalidated. Please try signing in again.",
       "type": "invalid_request_error",
       "param": null,
       "code": "refresh_token_invalidated"
     }
   }
   

   This happened even after completely resetting the local authentication state and performing a fresh OAuth login.

   Interesting additional sequence

   I also captured this sequence during another reproduction:

   getAuthStatus
   Refreshing token
   POST https://auth.openai.com/oauth/token
   500 Internal Server Error
   

   Request ID:

   e0dac80c-65f9-40f4-9f9b-2829ff2b2c7c
   

   The returned server error was:

   The server had an error processing your request.
   

   Approximately 16 seconds later, the next refresh attempt returned:

   401 Unauthorized
   refresh_token_invalidated
   

   This makes me wonder whether there may be an interaction between refresh-token rotation and a failed/500 refresh response: e.g. the server may rotate/invalidate the refresh token but the client does not receive/persist the replacement token because the request returned 500.

   I cannot prove that interpretation from the client logs alone, but the sequence may be useful for investigation.

   Troubleshooting already performed

   • Codex Desktop sign out / sign in
   • Fresh browser OAuth
   • Completely closed Codex processes
   • Backed up and removed %USERPROFILE%\.codex\auth.json
   • Confirmed a new auth.json was created after fresh authentication
   • Reset-AppxPackage OpenAI.Codex
   • Reinstalled the Desktop app
   • Disabled Windows notifications
   • Tested with brand-new trivial threads
   • Confirmed Remote Control was not enabled
   • Confirmed no separate Codex CLI process was running during the failing Desktop reproduction
   • Tested Codex CLI independently: CLI works normally across multiple completed turns

   The problem continues after a fresh OAuth login.

   Process observation

   During reproduction there was one Desktop app-server process:

   ...\OpenAI.Codex_26.818.2441.0_x64__2p2nqsd0c76g0\app\resources\codex.exe
     -c features.code_mode_host=true app-server --analytics-default-enabled
   

   I did not find a second standalone Codex CLI process competing for the token during that reproduction.

   Expected behavior

   After a successful turn, Codex Desktop should remain authenticated and allow another turn.

   Actual behavior

   The turn itself completes successfully, but Desktop subsequently performs an auth refresh, receives refresh_token_invalidated, and returns to the ChatGPT sign-in screen.

   The same account continues to work normally in Codex CLI.

   I can provide additional sanitized logs_2.sqlite excerpts if useful.
4. GUOBAO-lm commented on Aug 20, 2026

   

   GUOBAO-lm

   on Aug 20, 2026

   More actions

   I can reproduce this on Windows with a newer build.

   Environment

   Windows 11 x64
   Microsoft Store package: OpenAI.Codex_26.818.2441.0_x64__2p2nqsd0c76g0
   Codex CLI: 0.148.0-alpha.21
   Desktop executable: ChatGPT.exe

   Behavior

   Browser OAuth completes successfully.
   Codex Desktop initially reports:
   authenticatedAccountPresent=true
   A few seconds later, the first authenticated request to:
   GET /backend-api/accounts/{account_id}/settings
   returns HTTP 401.
   Desktop log then reports:
   hasToken=false
   nullReason=auth_token_missing
   refreshToken=true
   tokenExpiryState=missing
   The account lookup then changes to:
   authenticatedAccountPresent=false
   failureType=account_info_token_unavailable
   The backend response is:
   Missing valid access token or actor biscuit
   The app returns to the sign-in flow.

   CLI comparison

   codex login status returns:
   Logged in using ChatGPT
   CLI authentication remains valid after 60+ seconds.
   The CLI continues to work while the Desktop app loses authentication.

   Troubleshooting already performed

   Removed/renamed %USERPROFILE%.codex\auth.json and performed a fresh OAuth login.
   Cleared the Electron/Web profile.
   Ran Reset-AppxPackage for OpenAI.Codex.
   Verified no CODEX_ACCESS_TOKEN, OPENAI_API_KEY, OPENAI_BASE_URL, OPENAI_API_BASE, or CODEX_HOME environment variables are set.
   Verified ChatGPT traffic is reachable through the configured proxy/TUN.
   Repair and full MSIX reset did not resolve the issue.

   The Desktop app still reproduces the same sequence after a full package reset:

   authenticatedAccountPresent=true
   → /accounts/{account_id}/settings HTTP 401
   → auth_token_missing
   → account_info_token_unavailable

   This appears to be Desktop-specific token/session handling, because the CLI remains authenticated using the same account.