Tracker: Codex business access-tokens broken (401 unauthorized)

Had a friend from a different company reproduce this on macos. Definitely a valid issue and I believe it affects all business/enterprise users. Surprised it's not tracked harder as this has started like 24 hours ago.

Seems broken, getting the same 401 error with old/fresh CODEX_ACCESS_TOKEN

Same issue here. getting 401 from codex backend.

Same. I perform this command to login

printenv CODEX_ACCESS_TOKEN | codex login --with-access-token

This started a few days back out of nowhere and is currently blocking our CI review pipeline: Ubuntu 24.04 with Codex v0.136.0. We have already tried generating new tokens and even generating a new codex seat. I have logged out, removed cache, and re-logged in several times. Same issue.

Also reproduced on Codex CLI v0.136.0 using a Business access token.

Auth file after:

printenv CODEX_ACCESS_TOKEN | codex login --with-access-token
````

contains:

```json
{
  "auth_mode": "agentIdentity",
  "OPENAI_API_KEY": null,
  "agent_identity": "<redacted>"
}

Command:

printenv CODEX_ACCESS_TOKEN | codex login --with-access-token
CODEX_HOOKS_DISABLED=1 codex exec --json "say hello"

Observed:

Reading access token from stdin...
Successfully logged in
{"type":"thread.started","thread_id":"<redacted>"}
{"type":"turn.started"}
{"type":"error","message":"Reconnecting... 2/5 (stream disconnected before completion: failed to send websocket request: Connection closed normally)"}
{"type":"error","message":"Reconnecting... 3/5 (stream disconnected before completion: failed to send websocket request: Connection closed normally)"}
{"type":"error","message":"Reconnecting... 4/5 (stream disconnected before completion: failed to send websocket request: Connection closed normally)"}
{"type":"error","message":"Reconnecting... 5/5 (stream disconnected before completion: failed to send websocket request: Connection closed normally)"}
{"type":"error","message":"Reconnecting... 1/5 (unexpected status 401 Unauthorized: {\"detail\":\"Unauthorized\"}, url: https://chatgpt.com/backend-api/codex/responses, cf-ray: <redacted>, request id: <redacted>)"}
{"type":"error","message":"Reconnecting... 2/5 (unexpected status 401 Unauthorized: {\"detail\":\"Unauthorized\"}, url: https://chatgpt.com/backend-api/codex/responses, cf-ray: <redacted>, request id: <redacted>)"}
{"type":"error","message":"Reconnecting... 3/5 (unexpected status 401 Unauthorized: {\"detail\":\"Unauthorized\"}, url: https://chatgpt.com/backend-api/codex/responses, cf-ray: <redacted>, request id: <redacted>)"}
{"type":"error","message":"Reconnecting... 4/5 (unexpected status 401 Unauthorized: {\"detail\":\"Unauthorized\"}, url: https://chatgpt.com/backend-api/codex/responses, cf-ray: <redacted>, request id: <redacted>)"}
{"type":"error","message":"Reconnecting... 5/5 (unexpected status 401 Unauthorized: {\"detail\":\"Unauthorized\"}, url: https://chatgpt.com/backend-api/codex/responses, cf-ray: <redacted>, request id: <redacted>)"}
{"type":"error","message":"unexpected status 401 Unauthorized: {\"detail\":\"Unauthorized\"}, url: https://chatgpt.com/backend-api/codex/responses, cf-ray: <redacted>, request id: <redacted>"}
{"type":"turn.failed","error":{"message":"unexpected status 401 Unauthorized: {\"detail\":\"Unauthorized\"}, url: https://chatgpt.com/backend-api/codex/responses, cf-ray: <redacted>, request id: 146c3f5b-26ee-44cf-ae37-7f5cb4fd96e1"}}

Final request ID from this repro:

146c3f5b-26ee-44cf-ae37-7f5cb4fd96e1

<img width="775" height="194" alt="Image" src="https://github.com/user-attachments/assets/d9a5f791-f4f1-4ca5-be57-fe0d54a8b785" />

My existing access tokens seem to work again. For some reason I can't change my access tokens anymore though:

Access token creation is disabled
Enable "Allow users to create personal access tokens" in ChatGPT > Admin > Permissions & roles > Access tokens to let workspace members create access tokens.

I can't even revoke them! That setting does not show up on the dashboard.

Exact same problem, on a business account and getting "Access token creation is disabled" but there's no "Permissions & roles" setting to toggle

https://chatgpt.com/admin/access-tokens

<img width="1165" height="287" alt="Image" src="https://github.com/user-attachments/assets/5c19ce92-1d10-4d4e-97ab-e2ef2352bee0" />

Button goes to https://chatgpt.com/admin/permissions, but there is no "Allow users to create personal access tokens" setting, all I can see for "token" related results is a "token expiration" setting:

<img width="961" height="483" alt="Image" src="https://github.com/user-attachments/assets/a28779c4-0408-4f94-a49a-c294dcf49c62" />

Getting the same on a paid business account. I re-login, send couple messages in Codex - revoked again. Both seats getting revoked. When logging in, have to "confirm the phone" every time now.
OpenAI seems to hate its paying customers.

Very disappointed.
Thinking about moving to Claude.

Didn't get to use these accounts at all.
Yet, can't even request a refund:

So, OpenAI took my money, won't let me use Codex, and I can't even request a refund?

<img width="1316" height="949" alt="Image" src="https://github.com/user-attachments/assets/8a738bfc-102b-40d0-be3d-f6da99af3ce2" />

<img width="871" height="235" alt="Image" src="https://github.com/user-attachments/assets/a632faae-4012-448f-b9e5-b83f4f0bb451" />

The setting is now visible, but no flag to actually set it yet.

This feature rollout has arguably been insane from a professionalism perspective... Feels like an intern is in charge of it.

The setting has now become settable! 🥳 Sadly, the new tokens still don't work:

The new token does not improve things. Tested both documented paths in an isolated CODEX_HOME:

  - codex login --with-access-token fails with personal access token metadata request failed with status 403 Forbidden.
  - CODEX_ACCESS_TOKEN=... codex exec ... fails with the same 403 before any run starts.

Same, I can generate new tokens (now with the at-... prefix). I can echo "<TOKEN>" | codex login --with-access-token but then any prompts inside Codex still fail with the following error:

Codex CLI v0.141.0 error:

■ stream disconnected before completion: You didn't provide an API key. You need
to provide your API key in an Authorization header using Bearer auth (i.e.
Authorization: Bearer YOUR_KEY), or as the password field (with blank username) if
you're accessing the API from your browser and are prompted for a username and
password. You can obtain an API key from
https://platform.openai.com/account/api-keys.

Business Accounts for OAUTH are broken completely, a lot of users including me are facing frequent (hourly, daily) revokation of oauth tokens without sharing any accounts across multiple machines. We just use two busines seats from the same workspace and switch the account by "rotating" the auth.json between codex-sessions... OpenAI doesnt seem to like paying customers...

If someone else is completely blocked by this, it seems like using the OpenAI API token (as opposed to the Codex API token) works ok. Use the --with-api-token option. It's less than ideal, but it's something...

What version of the Codex App are you using (From “About Codex” dialog)?
codexcli v0.142.5

What subscription do you have?
Business

same issue for my team, please fix it as soon as possible.
I promoted the company to use Codex Business, but this problem occurs frequently, which has made my colleagues very disgusted. They hope to switch to Claude. This is the commercial version, why would such a basic problem occur? No commercial company should treat business customers like this.

First of all, business clients and ordinary users have different usage patterns. We will purchase multiple business accounts, but some people only use GPT (for example, non-programmers), while programmers use Codex CLI. We will use a gateway similar to codex-lb to allocate the Codex quota to programmers across the entire company, so as to balance expenses. But now there is a widespread problem of being forced to log in again, which has caused great trouble to our company's operation and maintenance.

ANY FIX PLANNED? Or does openai just ignore paying customers?

Fully works again on our business, leaving tracker open for other users as it appears that others still have some issue.

It worked for me until 0.144.5, when it cannot load the cloud config bundle: Error: Failed to load cloud config bundle (workspace-managed policies). Reverting to 0.144.4 fixes it.

Edit: both work for me now.