Business Codex unusable (USA region, Ubuntu dev container): repeated 401 "invalidated oauth token" / token revocation / forced phone verification on both seats

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #27872
• #28349

Powered by Codex Action

Potential duplicates detected. Please review them and close your issue if it is a duplicate. Codex Local auth redirects to add-phone in Israel; no SMS option, Cloud/API work #27872 Cannot login to work codex account anymore #28349 _Powered by Codex Action_

Absolutely different.

I am seeing the same pattern on a paid Pro/Business-enabled account since around 2026-06-16 evening Asia/Shanghai.

Observed behavior:

• ChatGPT web remains accessible on the same account/session.
• Codex CLI / Codex Desktop OAuth device login now redirects to phone verification / add-phone during re-auth.
• Advanced Account Security / MFA is enabled, but Codex still forces a phone/SMS-style verification step rather than using the configured stronger authentication method.
• Existing Codex refresh tokens that worked previously were invalidated, so re-auth is required; the re-auth then blocks at the phone verification step.
• This looks Codex OAuth-specific rather than a general ChatGPT web login failure.

Environment:

• macOS, Apple Silicon
• Global CLI: codex-cli 0.140.0
• Install method: npm global package @openai/codex@0.140.0 under the Homebrew Node prefix
• Codex Desktop bundled CLI also present: codex-cli 0.140.0-alpha.19

A Help Center support conversation has already been escalated to a support specialist. Please route this to the Codex auth/account team; the practical ask is either an account-side unblock or a secure non-phone verification path for Codex OAuth re-auth.

Update: still reproduces on 2026-06-18. Isolated CODEX_HOME codex login --device-auth redirects to auth.openai.com/add-phone before completing Codex OAuth. Support case 10188773 is open/escalated.

Still reproduces.

Still happening.
(preventing an issue auto-close due to "inactivity").

got same problem kinda for several days, using Ubuntu with openclaw on 4 OpenAI workspace business accounts with an automatic oauth-switch to use token equally. Maybe working on this caused it, but I dont know. Edit: It somehow also btw revoked my codex token in vs code...
###
debug agent/embedded {"subsystem":"agent/embedded"} -: 2026-06-30T23:46:49.046298Z ERROR codex_models_manager::manager: models: 401 Unauthorized: Your a…tion . again., url: https://chatgpt.com/backend-api/codex/models?client_version=0.139.0, cf-ray: a1410d704c95d35e-FRA, : 401, *** code: token_invalidated
###
Somehow with minimal config I managed to fix it. I went with chatgpt 5.5 thinking though all possibilities for too many houres. I cleared all possible token locations, all sessions and finally I could connect over konsole - not over telegram. Maybe it was two calls at once causing the revoke of the auth-token. I let openclaw and chatty write this for you, I hope it helps you and your ai solving the issue:
###
I had a similar OpenClaw/Codex OAuth issue with repeated 401 token_revoked / token_invalidated errors against:

https://chatgpt.com/backend-api/codex/models
wss://chatgpt.com/backend-api/codex/responses

What helped was narrowing down the auth path instead of only reauthing blindly:

1. Check the failing run logs for authProfileId. Make sure the failing Codex run actually uses the profile you expect.

1. Check whether the error happens during startup, boot, Telegram/session recovery, or only after a user message. In my case it eventually failed already during the agent:main:boot Codex call.

1. Inspect the OpenClaw auth store/state:

python3 - <<'PY'
import json, sqlite3
db="/root/.openclaw/agents/main/agent/openclaw-agent.sqlite"
con=sqlite3.connect(f"file:{db}?mode=ro", uri=True)
s=json.loads(con.execute("select state_json from auth_profile_state where state_key='primary'").fetchone()[0])
st=json.loads(con.execute("select store_json from auth_profile_store where store_key='primary'").fetchone()[0])
con.close()
print("order:", (s.get("order") or {}).get("openai"))
print("lastGood:", (s.get("lastGood") or {}).get("openai"))
print("profiles:", sorted((st.get("profiles") or {}).keys()))
PY

1. For debugging, reduce auth to one known-good OAuth profile. Remove stale/old profiles from auth_profile_store and auth_profile_state only after backing up the SQLite file.

1. Check for stale native Codex files in:

/root/.openclaw/agents/main/agent/codex-home

In my case I moved away old files like:

auth.json
models_cache.json

1. After a fresh OAuth login, test the stored access token directly against the same Codex endpoint that fails:

python3 - <<'PY'
import json, sqlite3, urllib.request, urllib.error
db="/root/.openclaw/agents/main/agent/openclaw-agent.sqlite"
profile="openai:your-profile@example.com"
url="https://chatgpt.com/backend-api/codex/models?client_version=0.139.0"
con=sqlite3.connect(f"file:{db}?mode=ro", uri=True)
raw=con.execute("select store_json from auth_profile_store where store_key='primary'").fetchone()[0]
con.close()
access=json.loads(raw)["profiles"][profile]["access"]
req=urllib.request.Request(url, headers={"Authorization":f"Bearer {access}","Accept":"application/json"})
try:
    with urllib.request.urlopen(req, timeout=30) as r:
        print("HTTP", r.status)
except urllib.error.HTTPError as e:
    print("HTTP", e.code)
    print(e.read().decode("utf-8","replace")[:1000])
PY

If this returns HTTP 200, the token itself is valid and the issue is probably in the managed Codex app-server/session/cache path. If it returns 401, the OAuth token is actually invalid for Codex and you need to reauth.

1. Restart the gateway and test from the console first:

openclaw chat

For me, a fresh OAuth login plus removing stale Codex auth/cache files and then starting a console chat restored the managed Codex state. The exact root cause was not fully clear, but it was not simply auth.order; it looked like stale/invalidated Codex OAuth state between OpenClaw’s SQLite auth store and the managed Codex app-server.
###

The issue persists.

Still happening.

Still happening. Still getting invalidated. Still have to confirm our phone each time we re-authenticate.
Static IP, barely use the accounts.

Can OpenAI finally fix this?

Update: still reproduces on 2026-06-18. Isolated CODEX_HOME codex login --device-auth redirects to auth.openai.com/add-phone before completing Codex OAuth. Support case 10188773 is open/escalated.

If it still repro's for you too, please like the OP.
I think they track that.

Thanks