[Windows] Sign in with ChatGPT still generates & requires an API key (Pro user) → API charges; revoking key breaks CLI
Summary
As a ChatGPT Pro user, I expected Codex CLI to work under my Pro plan without consuming API credits. However, the “Sign in with ChatGPT” flow auto‑creates an API key for my selected API org/project. If I revoke that key to avoid API charges, the CLI fails with 401 Incorrect API key provided and then forces me to sign in again, which creates a new API key. In short, there seems to be no way to use Codex CLI without an API key being generated and billed to the API account.
Environment
- Codex CLI:
0.19.0(output ofcodex --version) - Install method:
npm i -g @openai/codex - OS: Windows 11 (running in Git Bash / MINGW64; not using WSL for this repro)
- Organization:
Personal→Default project - Config directory:
~/.codex/(anauth.jsonfile appears after login)
Steps to Reproduce
- Ensure no
OPENAI_API_KEYis set in the environment and remove any previous Codex state:
- Delete
~/.codex/(or at least~/.codex/auth.json).
- Run
codexand select “Sign in with ChatGPT”. - In the browser, select my API Organization and Default project, then click Continue.
- Observe that an API key named “Codex CLI (auto‑generated)” is created in the API dashboard, and
~/.codex/auth.jsonnow holds credentials (including ansk-proj-...key). - Revoke that auto‑generated key in the API dashboard.
- Run
codexagain.
Actual behavior
- The CLI shows:
````
system ⚠️ OpenAI rejected the request ...
Error details: Status: 401, Code: invalid_api_key, Message: 401 Incorrect API key provided: sk-proj-***********...
- The CLI asks me to log in again; completing login creates a new API key. I cannot run Codex CLI without having an active API key, which leads to API charges.
Expected behavior
- As a Pro user using “Sign in with ChatGPT”, I expected a mode that does not create or require an API key and does not consume API credits, or at least a clear toggle (“use ChatGPT plan entitlements only”).
- If I “Disconnect” Codex CLI in ChatGPT settings or revoke the key, Codex CLI should not silently recreate a billable key.
What I tried (no change)
- Deleted
~/.codex/and re‑logged in. - Ensured
OPENAI_API_KEYis unset. - Revoked the “Codex CLI (auto‑generated)” key multiple times — CLI always re‑creates a new key after login.
Logs
From the CLI run after revoking the key (redacted):
system ⚠️ OpenAI rejected the request (request ID: req_19a4b978fff39e57e93e03f92d4c027a).
Error details: Status: 401, Code: invalid_api_key, Type: invalid_request_error,
Message: 401 Incorrect API key provided: sk-proj-***eZoA.
I can also provide ~/.codex/log/codex-tui.log with RUST_LOG=codex_core=debug,codex_tui=debug if needed.
Why I believe this is a bug/UX gap
- The official “Sign in with ChatGPT” docs say the flow creates a key automatically and that Disconnect only removes the OAuth grant, not the key itself. This appears to leave no path to run Codex CLI under a Pro plan without a billable API key.
- The README also instructs users migrating from API key billing to ensure
OPENAI_API_KEYis unset and re‑login; however, re‑login still auto‑creates a key, so billing remains tied to API.
Request
- Provide a “Pro/Plus entitlement” mode that does not rely on an API key (or at least a setting to not auto‑create one).
- Alternatively, clearly document that Codex CLI currently requires an API key and will bill the API account (even for Pro users), and outline how/when this will change.
- If a non‑API billing mode is planned, please share timelines or a beta flag we can test.
<img width="616" height="458" alt="Image" src="https://github.com/user-attachments/assets/65d2e59c-e083-4e3d-9384-8d7d173560dc" />
Showing cached comments. Read the full discussion on GitHub ↗
52 Comments
I believe that we are shipped with older version of CLI for windows.
Tried to build codex-rs for windows, got error about "Keyboard progressive enhancement not implemented for the legacy Windows API." which is from crossterm.
Managed to build with commented lines (just to check my assumption)
In
codex-rs\tui\src\tui.rsAnd it worked - managed to make some requests to GPT. But the problem is that I can't pass login stage with this built version, so only worked for me because I logged in with my npm-shipped version and then launched this built one.
same issue as: https://github.com/openai/codex/issues/1953
I apologize for the inconvenience, login with ChatGPT is not fully working on Windows, we're working hard on fixing it.
Same problem here
Very hot off the presses, but
0.20.0in npm https://www.npmjs.com/package/@openai/codex has some key fixes for Windows:Same problem on a pro account
<img width="552" height="259" alt="Image" src="https://github.com/user-attachments/assets/4261ddc3-2359-436b-9d91-543e179c0036" />
@bolinfest - thank you! confirm it works now.
@mickahouan for good measure, can you delete
%USERPROFILE%\.codex\auth.jsonand try again to make sure you're doing a clean auth flow on 0.20.0?Also, maybe unset
modelinconfig.tomlor perhaps other things?Ok, everything works. Thanks a lot @bolinfest
on Windows with 0.20.0 I get: login_with_chatgpt subprocess failed
I'm a pro user, on windows. Using .19. I'm getting charged for API usage when I shouldn't be.
Sign in with ChatGPT to use Codex as part of your paid plan
or connect an API key for usage-based billing
Usage included with Plus, Pro, and Team plans
Pay for what you use
Press Enter to continue
login_with_chatgpt subprocess failed
See above: 0.20.0, delete auth.json, try
codex loginagain?See above: 0.20.0, delete auth.json, try
codex loginagain?Right now it works on 0.20.0 with Windows cmd's clients.
But another, old bug with WSL 2 (Ubuntu) still there. Its another case when codex cant login you via browser from WSL.
I guess we can close this issue ?
4erdenko, when you say it works, do you mean, you've downloaded .20, recreated signin, used codex cli and you've checked to see that you are NOT being charged for api consumption??
Randy Blasik
My availability to @.***?anonymous&ep=signature>
________________________________
From: 4erdenko @.*>
Sent: Saturday, August 9, 2025 11:22:18 AM
To: openai/codex @.*>
Cc: Randy Blasik @.>; Comment @.>
Subject: Re: [openai/codex] [Windows] Sign in with ChatGPT still generates & requires an API key (Pro user) → API charges; revoking key breaks CLI (Issue #2000)
[https://avatars.githubusercontent.com/u/93295097?s=20&v=4]4erdenko left a comment (openai/codex#2000)<https://github.com/openai/codex/issues/2000#issuecomment-3171643611>
Right now it works on 0.20.0 with Windows cmd's clients.
But another, old bug with WSL 2 (Ubuntu) still there. Its another case when codex cant login you via browser from WSL.
I guess we can close this issue ?
—
Reply to this email directly, view it on GitHub<https://github.com/openai/codex/issues/2000#issuecomment-3171643611>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BEAXINWQ2XCVRDJDTZ2ZRRL3MYG2VAVCNFSM6AAAAACDNFR43GVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCNZRGY2DGNRRGE>.
You are receiving this because you commented.Message ID: @.***>
Yes. At the moment, I don’t have an API key in auth.json, and I’m getting the default GPT-5 model. No money has been deducted. So yes, THAT problem is solved.
The output format is terrible, but that’s unrelated to the issue.
You sir, are a bit of a hero to me. Thank you for your quick response. Ill hop on and test.
Randy Blasik
My availability to @.***?anonymous&ep=signature>
________________________________
From: 4erdenko @.*>
Sent: Saturday, August 9, 2025 11:32:50 AM
To: openai/codex @.*>
Cc: Randy Blasik @.>; Comment @.>
Subject: Re: [openai/codex] [Windows] Sign in with ChatGPT still generates & requires an API key (Pro user) → API charges; revoking key breaks CLI (Issue #2000)
[https://avatars.githubusercontent.com/u/93295097?s=20&v=4]4erdenko left a comment (openai/codex#2000)<https://github.com/openai/codex/issues/2000#issuecomment-3171775205>
4erdenko, when you say it works, do you mean, you've downloaded .20, recreated signin, used codex cli and you've checked to see that you are NOT being charged for api consumption??
Randy Blasik
My availability to @.***?anonymous&ep=signature>
…
Yes. At the moment, I don’t have an API key in auth.json, and I’m getting the default GPT-5 model. No money has been deducted. So yes, THAT problem is solved.
The output format is terrible, but that’s unrelated to the issue.
—
Reply to this email directly, view it on GitHub<https://github.com/openai/codex/issues/2000#issuecomment-3171775205>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BEAXINROFBPNLEREF3AXJRT3MYICFAVCNFSM6AAAAACDNFR43GVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCNZRG43TKMRQGU>.
You are receiving this because you commented.Message ID: @.***>
in my opinion the log out, log in feature should be improved (user experience wise). but you guys did fix the main annoying issues so good job.
I deleted the entriy .codex folder and still get login_with_chatgpt subprocess failed
@jacobhallgren do you have
python3on yourPATH? The login flow currently runs a Python script, though https://github.com/openai/codex/pull/2047 is in the works to eliminate that.I guess we can close this issue ?
@4erdenko For now, you need to copy the
~/.codex/auth.jsonfile that you created on a machine where you were able to log in vialocalhostto the [presumably] headless machine (WSL 2 in this case).@4erdenko (and others who have hit this issue), I put up https://github.com/openai/codex/pull/2121 to provide more detailed information, as this is a common situation today, particularly for Windows/WSL users.
****
I am still not able to login is this issue still occuring for everyone?
Yes I use python a lot and have it in my path so python works for me, but this still fails for me when trying to login.
@PGrayCS Yes it's working for me I'm on windows + codex cli 0.20. I gave errors to chatgpt when trying it after an update from .19. It walked me through the fixes. I needed to fix path issues, and a few other things to get it to work.
I'm on Windows in a cmd.exe shell with codex CLI 0.20. When I run it and opt to sign in with ChatGPT, I get "program not found." I do have python3 in my path, but I don't have python3.exe in my path, due to the way I installed Python, via pyenv. To fix this, I plan to move away from pyenv.
As installed under pyenv, my Python3 shows up in my path like:
C:\Users\liamd>where python3
C:\Users\liamd\.pyenv\pyenv-win\shims\python3
C:\Users\liamd\.pyenv\pyenv-win\shims\python3.bat
The python3 file without an extension is actually a shell script with a shebang in it, a wrapper like the batch file is.
C:\Users\liamd\.pyenv\pyenv-win\shims>cat python3.bat
@echo off
chcp 1250 > NUL
call pyenv exec %~n0 %*
C:\Users\liamd\.pyenv\pyenv-win\shims>cat python3
#!/bin/sh
pyenv exec $(basename "$0") "$@"
And in C:\Users\liamd\.pyenv\pyenv-win\shims I don't have a Python.exe. Instead, I have just about every other name for Python, e.g.:
08/01/2025 03:51 PM 45 python
08/01/2025 03:51 PM 45 python-argcomplete-check-easy-install-script
08/01/2025 03:51 PM 53 python-argcomplete-check-easy-install-script.bat
08/01/2025 03:51 PM 53 python.bat
08/01/2025 03:51 PM 45 python3
08/01/2025 03:51 PM 45 python3.11
08/01/2025 03:51 PM 53 python3.11.bat
08/01/2025 03:51 PM 45 python3.7
08/01/2025 03:51 PM 53 python3.7.bat
08/01/2025 03:51 PM 53 python3.bat
08/01/2025 03:51 PM 45 python311
08/01/2025 03:51 PM 53 python311.bat
08/01/2025 03:51 PM 45 python37
08/01/2025 03:51 PM 53 python37.bat
08/01/2025 03:51 PM 45 pythonw
08/01/2025 03:51 PM 53 pythonw.bat
08/01/2025 03:51 PM 45 pythonw3
08/01/2025 03:51 PM 45 pythonw3.11
08/01/2025 03:51 PM 53 pythonw3.11.bat
08/01/2025 03:51 PM 45 pythonw3.7
08/01/2025 03:51 PM 53 pythonw3.7.bat
08/01/2025 03:51 PM 53 pythonw3.bat
08/01/2025 03:51 PM 45 pythonw311
08/01/2025 03:51 PM 53 pythonw311.bat
08/01/2025 03:51 PM 45 pythonw37
08/01/2025 03:51 PM 53 pythonw37.bat
26 File(s) 1,274 bytes
Switched to WSL and got further:
"Starting local login server on http://localhost:1455"
The page never loads. The browser eventually gives me a 404.
The CLI dies just as it's printing this:
"If your browser did not open, navigate to this URL to authenticate:
https://auth.openai.com/oauth/authorize?response_type=code&client_id=app_EMoamEEZ73f0CkXaXp7hrann&redirect_uri=http%3A%2F%2Flocalhost%3A1455%2Fauth%2Fcallback&scope=openid+profile+email+offline_access&code_challenge=6bKLETH2WA-HYaExbqdqhEdLxO41w2HTVmIRPDY2mpA&code_challenge_method=S256&id_token_add_organizations=true&codex_cli_simplified_flow=true&state=77000984903fb58def3efb5ec847b165d9029a2a8320c0e155867ecca9ec891c
Error logging in: login_with_chatgpt subprocess failed:"
The Codex CLI program that has just died also ran the local web server process. So, after I go through the OAuth flow at the above URL, the callback webhook is attempted but fails because the local server is dead already.
Edit: I kept trying this, and eventually this did work, for some reason!
Because want Python from Microsoft store (why??). After that it works for me.
This is how I fixed it - thanks to ChatGPT for 100% doing this I take no credit! GPT5 is amazing :D
Root cause
Codex CLI 0.20 starts its login flow by launching python3.
If Windows can’t find a real python3.exe on your PATH (e.g., only pyenv shims or a python3.bat), the spawn fails and you get that error. A second common issue is that codex itself isn’t on PATH in cmd.exe (npm global bin missing).
TL;DR Fix
Make sure Windows has a real python3.exe:
Install Python 3.13 from Microsoft Store, then enable its alias:
Settings → Apps → Advanced app settings → App execution aliases → turn ON “Python 3.13 (python3.exe)”.
---
Fix:
codex login→ “Error logging in: program not found” on Windows (Codex CLI 0.20)Symptom
Root cause (Windows)
Codex 0.20 tries to launch
python3during its login flow. If there isn’t a realpython3.exeon yourPATH(e.g., only pyenv shims or a.bat), the spawn fails and you get this error. A separate hiccup is whencodexitself isn’t onPATHincmd.exe.---
TL;DR (works reliably)
Settings → Apps → Advanced app settings → App execution aliases → turn ON:
Python 3.13 (python3.exe)(Optional: also enable
Python 3.13 (python.exe).)python3.exe(if you created one earlier):cmd.exe):If
where codexstill shows nothing, run it directly:If the browser doesn’t open automatically while
codex loginis running:---
Alternative (avoid Microsoft Store)
If you have a regular Python install:
python.exe(e.g.C:\Users\<you>\AppData\Local\Programs\Python\Python313\python.exe).python3.exe:``
cmd
``copy C:\...\python.exe C:\...\python3.exe
PATHahead of any pyenv shim directories.``
cmd
``where python3
python3 --version
codex login
---
Gotchas (Windows)
pyenv-winprovidespython3shims (python3,python3.bat) but not a realpython3.exe→ Codex fails.setx PATH ...truncates to 1024 chars. For permanent changes, use System Properties → Environment Variables and add entries there.%APPDATA%\npm(wherecodex.cmdlives) must be onPATHincmd.exe.---
Verification checklist
<details>
<summary>Why this happens</summary>
Codex’s login flow shells out to
python3even on Windows. If Windows can’t resolve a native executable atpython3.exe, the spawn fails with “program not found.” Enabling the Microsoft Storepython3.exealias (or providing a realpython3.exenext to yourpython.exe) fixes the underlying process launch.</details>
::contentReference[oaicite:0]{index=0}
I prefer them to fix this native in the code instead of the user doing this
I solved doing this:
New-Item -ItemType SymbolicLink -Path "C:\Python313\python3.exe" -Target "C:\python313\python.exe"
p.s. I have py in c:\Python313 folder
I’ll just wait, if the OpenAI devs can’t even get the installer working, it doesn’t inspire much confidence in their coding agent.
You just need to have python3.exe in your path. It's not really a codex problem.
I have python in my path and it works great for everything except codex.
What error are you getting?
It is a codex problem since python3.exe does not exist on windows after python official installation, unless you do some custom fix to make this work
That it don't find python.
Agree 100%
@joshleblanc this one
That doesn't sound like python missing, unless the built version has less verbose errors than the dev build. The errors I got while testing the change very explicitly stated what was missing and how to fix it (because windows hijacks the python bindings by default).
Wonder if it's something up with your temp directory. I don't suppose your user profile had a space in it?
Did you delete the .codex dir in %userprofile%?
I'm just spit balling here.
Yes, same error.
I have python.exe in my path.
I fixed with a symlink named python3.exe to python.exe with the command described above.
Why cant you guys make the script just work with the standard "python" environment variable?
what is the env variable you are mentioning exactly ?
if you would like to provide exactly how to perform the test you are mentioning, I will do that.
instead of the script using python3 it should also work with "python" that is standard on windows.
!Image
I am getting a "Program not found" error when I select the browser option. Does anyone have a fix for that?
Hey everyone, just an update. After installing Python 3.13 from the Microsoft Store, running codex login worked.
If you have been running into issues related to the Python stuff, please update to 0.22.0 as we migrated the Python code to Rust in the new release: https://github.com/openai/codex/releases/tag/rust-v0.22.0
As an added bonus, 0.22.0 now supports Markdown and streaming!
Looks really great! Thank you.
And again, initial problem was solved too, earlier.