VS Code extension authentication fails after update (attachAuth=false, GET /settings/user returns 403)

Experiencing this same issue

This appears related to #35182. In my case, the Codex Output log also consistently shows:

routePattern=/settings/user
status=403
attachAuth=false
attachIntegrityState=false

ChatGPT Web and Codex Web work normally with the same ChatGPT Pro account.

Another Windows user confirms the same failure pattern:

• Codex panel only shows “Something went wrong / try again”
• chatgpt-account-lookup reports authenticatedAccountPresent=true
• the next request fails with 403 Forbidden for /settings/user
• the webview then enters an error boundary
• reinstalling the extension, reloading/restarting VS Code, and signing out in the browser did not help

Affected version: v26.721.30844.

Downgrading specifically to v26.715.61943 immediately restored normal operation. This strongly suggests a regression introduced in v26.721.30844 or its associated auth request path rather than missing Codex account permissions or damaged local session data.

Thank you for sharing this!

Your comment helped me identify the root cause. I downgraded from v26.721.30844 to v26.715.61943, restarted the extension, and the issue was resolved immediately.

This confirms that the problem is very likely a regression introduced in v26.721.30844 rather than an account or local configuration issue.

I really appreciate you taking the time to post the workaround—it saved me a lot of troubleshooting.

Thanks!

Another Windows user confirms the same failure pattern: Codex panel only shows “Something went wrong / try again” chatgpt-account-lookup reports authenticatedAccountPresent=true the next request fails with 403 Forbidden for /settings/user the webview then enters an error boundary * reinstalling the extension, reloading/restarting VS Code, and signing out in the browser did not help Affected version: v26.721.30844. Downgrading specifically to v26.715.61943 immediately restored normal operation. This strongly suggests a regression introduced in v26.721.30844 or its associated auth request path rather than missing Codex account permissions or damaged local session data.

Thanks... this fixed the issue

Another Windows user confirms the same failure pattern: Codex panel only shows “Something went wrong / try again” chatgpt-account-lookup reports authenticatedAccountPresent=true the next request fails with 403 Forbidden for /settings/user the webview then enters an error boundary * reinstalling the extension, reloading/restarting VS Code, and signing out in the browser did not help Affected version: v26.721.30844. Downgrading specifically to v26.715.61943 immediately restored normal operation. This strongly suggests a regression introduced in v26.721.30844 or its associated auth request path rather than missing Codex account permissions or damaged local session data.

It did not help downgrading to that version, still same error

2026-07-25 21:02:06.225 [error] Error fetching httpStatus=403 requestId=a20f7a19ea8bd597-SCL statusText=Forbidden url=/settings/user
2026-07-25 21:02:06.332 [warning] sa_server_request_failed attachAuth=false attachIntegrityState=false error={} hasRequestBody=false method=get requestHeaderNames=["OAI-Language","User-Agent","oai-did","originator","sec-ch-ua","sec-ch-ua-mobile","sec-ch-ua-platform"] routePattern=/settings/user status=403 url=/settings/user
2026-07-25 21:02:06.595 [warning] [git] git.command.complete aborted=false allowedNonZeroExitCodes=null argsCount=3 command="git -c core.hooksPath=NUL -c core.fsmonitor= config --get remote.origin.url" commandArgs=["git","-c","core.hooksPath=NUL","-c","core.fsmonitor=","config","--get","remote.origin.url"] cwd=C:\Users\diego\OneDrive\Developments\private\.git durationMs=58 exitCode=1 failureReason=command_failed hostId=local id=7202ab55 isRemote=false outputLimitExceeded=false outputLimitMaxBytes=null outputLimitStream=null requestKind=git-origins source=sidebar_workspace_groups startTimeMs=1785027726536 stderrBytes=0 stdoutBytes=0 subcommand=config success=false timedOut=false
2026-07-25 21:02:14.152 [error] Error fetching httpStatus=403 requestId=a20f7a4b7bcde7ab-SCL statusText=Forbidden url=/settings/user
2026-07-25 21:02:14.153 [warning] sa_server_request_failed attachAuth=false attachIntegrityState=false error={} hasRequestBody=false method=get requestHeaderNames=["OAI-Language","User-Agent","oai-did","originator","sec-ch-ua","sec-ch-ua-mobile","sec-ch-ua-platform"] routePattern=/settings/user status=403 url=/settings/user

2026-07-25 21:02:14.153 [warning] sa_server_request_failed attachAuth=false attachIntegrityState=false error={} hasRequestBody=false method=get requestHeaderNames=["OAI-Language","User-Agent","oai-did","originator","sec-ch-ua","sec-ch-ua-mobile","sec-ch-ua-platform"] routePattern=/settings/user status=403 url=/settings/user

<img width="282" height="141" alt="Image" src="https://github.com/user-attachments/assets/f566be92-9f7a-4f10-b894-a4fe9e545c12" />

Adding a reproduction from today's release on macOS — this is still occurring and got significantly worse with 26.5818.21641 (published 2026-08-20 ~03:08 UTC), which auto-updated mid-session.

Environment

• Extension: openai.chatgpt 26.5818.21641 (darwin-arm64)
• VS Code desktop, macOS (Darwin 25.2.0, arm64)
• codex-cli 0.147.0, logged in via ChatGPT

Symptoms after the auto-update

• Creating a chat fails with Error creating chat showing a serialized internal object instead of a real error: {"value":{},"source":"owned","hooks":[],"promises":[]} — the same payload appears in Codex.log for several distinct failures, so the underlying error seems to be lost before logging.
• The composer input locks up entirely on resumed threads.
• Codex.log shows a repeating loop:

[warning] sa_server_request_failed method=get routePattern=/settings/user status=403 attachAuth=false attachIntegrityState=false
[error] Error fetching httpStatus=403 requestId=a2df083a6f7bea96-ICN statusText=Forbidden url=/settings/user
[error] Failed to load config requirements error={"value":{},"source":"owned","hooks":[],"promises":[]}
[warning] [queued-followups] Failed to release send lock conversationId=<uuid> error={}
[warning] pinned_thread_sync_failed error={"value":{},"source":"owned","hooks":[],"promises":[]}

• A stale ~/.codex/thread-writer-locks/<conversation>.lock is recreated on every app-server restart while the thread resumes with markedStreaming=true, so the send lock is never released and the input stays disabled. Deleting the lock file does not help — it is recreated within a minute.

What is NOT broken

• Auth itself is fine: codex exec using the same ~/.codex/auth.json completes a model call successfully.
• ChatGPT web works with the same account.

Same root signature as the OP: the /settings/user request goes out with attachAuth=false and returns 403 (Cloudflare edge). Everything downstream (config requirements load, send-lock release, chat creation) fails from there.

Workaround that fully restored the extension for me:

1. code --install-extension openai.chatgpt@26.814.41407 (marketplace 26.5814.41407)
2. Pin the version ("pinned": true for the entry in ~/.vscode/extensions/extensions.json) so auto-update does not reinstall the broken build
3. Reload the window

Possibly related: #37856, #38876 (stale writer-lock / thread-owner blocking chat creation).