Device-code login hides disabled account setting until after repeated MFA loops

What issue are you seeing?

codex login --device-auth starts a device authorization flow even when device-code authorization is disabled in the ChatGPT account security settings. The flow asks the user to select an account and complete MFA, but only reveals the disabled setting after those steps. In our case, repeated redirects through welcome, account-selection, and MFA screens made the process look like an authentication loop and took about one hour to diagnose.

The actionable error eventually shown was:

Enable device code authorization for Codex in ChatGPT Security Settings, then run codex login --device-auth again.

Once that setting was enabled and the login flow was restarted with a fresh device code, authorization succeeded.

What steps can reproduce the bug?

1. Use a ChatGPT account where device-code authorization is disabled.
2. On a Linux machine with Codex CLI 0.145.0, run codex login --device-auth.
3. Open https://auth.openai.com/codex/device in a browser.
4. Select the ChatGPT account and complete the requested MFA challenge.
5. Observe redirects through sign-in/account-selection/MFA before the flow finally explains that device-code authorization is disabled.
6. Enable device-code authorization in ChatGPT Security Settings.
7. Run codex login --device-auth again and complete the flow with a fresh code.
8. Verify that codex login status now returns Logged in using ChatGPT.

What is the expected behavior?

The CLI or authorization endpoint should detect this account state before starting a flow that cannot succeed.

Ideally:

• codex login --device-auth performs a preflight check and immediately says that device-code authorization is disabled.
• The error includes a direct link to the exact ChatGPT security setting.
• The UI clearly distinguishes the numeric 6-digit MFA field from the later 9-character alphanumeric device-code field.
• Successful MFA state is preserved rather than returning the user to welcome or account-selection screens.
• Documentation explicitly says that a code generated on one computer can be approved in an authenticated browser on another computer.

Additional information

• Codex CLI: 0.145.0
• CLI host: Linux (Lenovo)
• Authorization browser: Linux (a second machine)
• Date/time: 2026-07-22, approximately 20:00–21:00 Atlantic/Canary
• MFA method: authenticator app
• Final result: login succeeded after enabling the account setting and restarting the device flow

No passwords, TOTP values, device codes, or account identifiers are included in this report.