Codex Desktop Slack connector keeps stale OAuth link after revoke/reconnect; no reliable hot-swap path for multi-Slack users

What version of the Codex App are you using (From “About Codex” dialog)?

26.422.30944

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 25.4.0 arm64 arm

What issue are you seeing?

Codex Desktop can keep using a stale managed Slack connector OAuth/link state after a user revokes the wrong Slack authorization and reconnects the intended Slack account in ChatGPT Apps.

This makes Slack account switching very difficult for developers who work across multiple Slack workspaces, clients, or businesses. In this case, the only working recovery path required Slack-side revoke, ChatGPT-side disconnect/reconnect, clearing Codex app tool cache, and restarting Codex.

The key symptom was that Codex continued routing Slack tool calls through a stale managed connector link after Slack was revoked/reconnected. The browser-side ChatGPT UI could show Slack as connected while Codex tool calls still failed.

Observed errors during recovery:

HTTP 401: invalid_token

After ChatGPT Settings -> Apps -> Slack -> Disconnect -> Connect, the running Codex session then changed to:

Unknown tool: slack_slack_read_user_profile
Unknown tool: slack_slack_search_channels

Only after moving aside the local Codex app tool cache and fully restarting Codex did the Slack tools refresh and start working again.

What steps can reproduce the bug?

1. In Codex Desktop, install/enable the curated Slack app connector.
2. Authenticate Slack with the wrong Slack account or workspace.
3. Attempt to use Slack from Codex. In my case this initially failed for the target private channel because the wrong Slack identity was connected.
4. Revoke the wrong Slack authorization from Slack's app authorization/configuration page.
5. Attempt to use Slack from Codex again.
6. Observe Codex Slack tools fail with:

HTTP 401: invalid_token

1. Reconnect Slack from the browser / ChatGPT app connector UI.
2. Observe ChatGPT web can show Slack as connected, but Codex Desktop still fails because its managed connector/tool state is stale.
3. In one recovery attempt, ChatGPT-side reconnect changed the Codex error from invalid_token to:

Unknown tool: slack_slack_read_user_profile

1. Move aside the local app-tool cache:

mv ~/.codex/cache/codex_apps_tools ~/.codex/cache/codex_apps_tools.bak

1. Fully quit and reopen Codex Desktop.
2. Slack tool calls finally refresh and work again.

During debugging, the local tool cache repeatedly regenerated with the same stale Slack connector/link identity. Exact connector/link IDs are omitted from this public report but can be provided privately if useful.

What is the expected behavior?

Codex Desktop should provide a clear, reliable way to:

• disconnect a managed app connector,
• revoke or forget the current connector link,
• force fresh OAuth,
• hot-swap between Slack identities/workspaces,
• refresh the local tool registry without requiring manual filesystem cache moves.

Codex should not continue routing managed Slack tool calls through a stale revoked connector link after reconnect.

When a managed connector returns invalid_token, Codex should guide the user to re-authenticate or automatically invalidate the stale local/remote connector state. The UI should not leave the user in a state where ChatGPT says Slack is connected but Codex tool calls still fail.

Additional information

Workaround found:

1. In ChatGPT web: Settings -> Apps -> Slack -> Disconnect.
2. Reconnect Slack and approve OAuth for the intended Slack workspace/account.
3. Quit Codex fully.
4. Move aside:

~/.codex/cache/codex_apps_tools

1. Reopen Codex.
2. Verify Slack tools with slack_read_user_profile and slack_search_channels.

Business / adoption impact:

This is a retention and adoption risk for developers and teams that rely on Slack as their primary operational channel. Many developers work across multiple businesses, agencies, clients, or internal/external Slack workspaces. If Codex cannot reliably hot-swap or reset Slack connector OAuth, users may lose trust in Codex for day-to-day engineering workflows and fall back to competing coding agents that make account switching clearer.

For teams evaluating Codex, connector reliability is part of the product's credibility. A confusing or fragile OAuth recovery path can block rollout even if the core coding experience is strong.

Suggested fixes:

• Add a Codex Desktop UI action to disconnect/reconnect managed app connectors directly from Codex.
• Add a "forget connector OAuth/link and refresh tools" action.
• Add CLI support for managed Codex app connectors, such as codex apps logout slack / codex apps login slack.
• Automatically invalidate stale connector/tool state when a managed app connector returns invalid_token.
• Support explicit Slack workspace/account selection or hot-swap for users with multiple Slack accounts.