Unable to logout/invalidate login credentials from auth.json

Note: I apparently missed that the "Log out all" button actually says:

Log out of all active sessions across all devices, including your current session. It may take up to 30 minutes for other devices to be logged out.

So it's possible that within 30 mins things will fix themselves (I will post back here). I don't know if that also applies to the other methods I used for logging out (in which case this might be WAI), however it seems odd to me that there is such a delay - if I was trying to secure my account because it was compromised, a lot could be done in 30 mins!

It's been over 30 minutes since I opened this issue (and over 2hrs since the "last_refresh" date in the JSON file I copied), but these credentials are still working fine copied into a brand new container, despite all the logout/revoke operations noted above.

<img width="569" height="934" alt="Image" src="https://github.com/user-attachments/assets/aba601e6-7074-48b1-8b34-fd6fcca7e41e" />

It's been over 24 hours now so I tried again. It seems to hang here:

{"model":"gpt-5","sandbox":"workspace-write [workdir, /tmp, $TMPDIR]","provider":"openai","workdir":"/workspace","reasoning effort":"medium","approval":"never","reasoning summaries":"auto"}
{"prompt":"Add a line to the bottom of README.md stating that it was last updated today.\n"}
{"id":"0","msg":{"type":"task_started"}}

I assume that the auth is now failing, but for some reason it doesn't terminate or print an error - I don't know if that's a different bug. It does at least look like the tokens aren't working, but I don't know why it took way longer than expected.

When you logout in the CLI, the local auth.json file is deleted. It does not invalidate the token on the server. If you have a copy of the token (e.g. in another copy of auth.json), you will be able to use that token until it expires. This explains the behavior you're seeing.

Does the codex logout command or the “Disconnect” button in the Security Settings invalidate the refresh token? Even if the refresh token is invalidated, does Codex still retain access until the exp time claimed in the JWT?

@jlzhjp I'm not sure which "Disconnect" button you mean, but from my comment above. I clicked the "Logout All" button in the ChatGPT app that says:

Log out of all active sessions across all devices, including your current session. It may take up to 30 minutes for other devices to be logged out.

However it definitely did _not_ expire the session within 30 minutes. Based on what I tried and the last comment above yours, I don't think there is _any way_ to invalidate the token besides wait for it to expire, and it's not clear to me what that expiry is (seems like it's over 2 hours but less than 24 hours).

@DanTup

I'm not sure which "Disconnect" button you mean

<img width="952" height="292" alt="Image" src="https://github.com/user-attachments/assets/46ec64ab-b2d2-467e-bd94-a5cad6fb4e69" />

I think they’re using JWT, which is stateless and, in theory, cannot be invalidated once issued. After examining the decoded JWT claims, I found that the token’s lifetime is 10 days. If I understand correctly, that means we have to wait 10 days for the token to expire.

#  "exp": 1762856570,
#  "iat": 1761992570,

❯ date -u -d @1761992570 #iat
Sat Nov  1 10:22:50 AM UTC 2025

❯ date -u -d @1762856570 #exp
Tue Nov 11 10:22:50 AM UTC 2025

I tried both the “Disconnect” button and “Log out of all devices,” but I could still access ChatGPT through both Codex and the Android app after an hour—only the web sessions were invalidated.

Strangely, after logging in again and repeating the same actions, I was unable to use Codex, which reported that “my refresh token has been invalidated,” yet the Android app continued to work. That’s really confusing.

One thing is clear, though: we should be more careful about uploading the auth.json file to remote servers, since it’s difficult to invalidate a token—or even confirm whether it has truly been invalidated.

@jlzhjp ah, I'm not sure that button was there when I tried (I think I would've spotted it since it's so obvious and close to the Logout All button I'd tested).

One thing is clear, though: we should be more careful about uploading the auth.json file to remote servers

Yep, this was my takeaway. It makes the text on the "Logout All" button rather misleading.. it's easy to assume a token is no longer valid when actually it is.