Repository navigation
codex login didn't support ChatGPT SSO #5553
Description
What version of Codex is running?
codex-cli 0.47.0
What subscription do you have?
Business Plan
Which model were you using?
not related
What platform is your computer?
Darwin 25.0.0 arm64 arm
What issue are you seeing?
codex login didn't works as expected when "Enforce SSO log in" on ChatGPT account.
What steps can reproduce the bug?
- Login to ChatGPT account where SSO is enabled and enforce
- Try run
codex exec "hello" - Got
exceeded retry limit, last status: 401 Unauthorized, request id: 99305b0bedfb45b1-BKK
What is the expected behavior?
Able to login successfully and chat with codex.
Additional information
The workaround I found is...
- run
codexthen run/logout - run
codexagain and login when it prompt - this will works until exit codex tui
I did some investigating on token and found that the jwt token created on first login, contains sso_connection_id field as well as sub fields having saml format. HOWEVER, on subsequence token missing sso_connection_id and sub fields having auth0 instead.
On first login
On subsequence execute
I also check network, and saw that openai return below error, when token missing sso_connection_id.
{
"detail": {
"code": "require_sso_login",
"account_name": "<account-name>"
}
}
Activity
pakrym-oai commentedon Oct 23, 2025
Thank you for the report, we are looking into it!
pakrym-oai commentedon Oct 23, 2025
Can you run
/feedbackafter getting a 401 error? That will share a bit more information that's helpful for debugging.melsharnou-chwy commentedon Oct 23, 2025
I also have a problem with SSO, I use
codex login, it opens the home page, I put the company email, it redirects to Okta then shows this error.The Okta login works fine for the ChatGPT website but not for codex cli
pakrym-oai commentedon Oct 24, 2025
@kamontat can you try deleting
~/.codex/auth.json, doing login and seeing whether it works across codex sessions?kamontat commentedon Oct 24, 2025
@pakrym-oai tried, several times, but no luck.
Here is the detailed steps with /feedback as you requested:
~/.codex/auth.jsonfilecodex, then login using oktacodexagainexceeded retry limit, last status: 401 Unauthorized, request id: ***I also notice that some time after first login, the token in auth.json got refreshed to invalid one (the one without sso_connection_id) even though the token is still valid.
I would love to help contributing and help fixes the issue.
pakrym-oai commentedon Oct 24, 2025
@kamontat I'd love your help! Can you try to debug why the token refresh is triggered? See CodexAuth.refresh_token
kamontat commentedon Oct 25, 2025
@pakrym-oai I'm no longer able to reproduce the premature refresh token today, so I need to wait for token to expire. As my suspect is on refresh flow.
etraut-openai commentedon Jan 10, 2026
Closing old bugs.