Windows Desktop hangs after successful OAuth and incorrectly reports "Your access token could not be refreshed because your refresh token was revoked

I am seeing what appears to be the same issue on a newer Windows Codex Desktop build, and I was able to capture the authentication sequence in logs_2.sqlite.

Environment

• Windows 11 x64
• Codex Desktop package: OpenAI.Codex 26.818.2441.0
• Desktop client reported in app-server logs: 26.818.21641
• Codex CLI: v0.148.0
• ChatGPT Plus
• Codex CLI authentication works normally with the same account

Symptom

Codex Desktop can authenticate successfully and can start a new thread normally.

For example:

1. Sign in to Codex Desktop with ChatGPT.
2. Create a fresh thread.
3. Send 1+1?.
4. The model responds normally with 2.
5. Shortly after the turn completes, the Desktop app switches back to the Sign in to ChatGPT screen.

This is reproducible even with a completely new thread and a trivial prompt.

Codex CLI does not reproduce the problem. I tested multiple consecutive turns in CLI successfully.

Authentication logs

The Desktop app calls getAuthStatus, reloads the current auth state successfully, and then attempts to refresh the token:

Reloading auth for account ...
Reloaded auth, changed: false
Refreshing token

The request to:

POST https://auth.openai.com/oauth/token

then returns:

401 Unauthorized

and the Codex auth manager logs:

Failed to refresh token: 401 Unauthorized

{
  "error": {
    "message": "Your refresh token has been invalidated. Please try signing in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "refresh_token_invalidated"
  }
}

This happened even after completely resetting the local authentication state and performing a fresh OAuth login.

Interesting additional sequence

I also captured this sequence during another reproduction:

getAuthStatus
Refreshing token
POST https://auth.openai.com/oauth/token
500 Internal Server Error

Request ID:

e0dac80c-65f9-40f4-9f9b-2829ff2b2c7c

The returned server error was:

The server had an error processing your request.

Approximately 16 seconds later, the next refresh attempt returned:

401 Unauthorized
refresh_token_invalidated

This makes me wonder whether there may be an interaction between refresh-token rotation and a failed/500 refresh response: e.g. the server may rotate/invalidate the refresh token but the client does not receive/persist the replacement token because the request returned 500.

I cannot prove that interpretation from the client logs alone, but the sequence may be useful for investigation.

Troubleshooting already performed

• Codex Desktop sign out / sign in
• Fresh browser OAuth
• Completely closed Codex processes
• Backed up and removed %USERPROFILE%\.codex\auth.json
• Confirmed a new auth.json was created after fresh authentication
• Reset-AppxPackage OpenAI.Codex
• Reinstalled the Desktop app
• Disabled Windows notifications
• Tested with brand-new trivial threads
• Confirmed Remote Control was not enabled
• Confirmed no separate Codex CLI process was running during the failing Desktop reproduction
• Tested Codex CLI independently: CLI works normally across multiple completed turns

The problem continues after a fresh OAuth login.

Process observation

During reproduction there was one Desktop app-server process:

...\OpenAI.Codex_26.818.2441.0_x64__2p2nqsd0c76g0\app\resources\codex.exe
  -c features.code_mode_host=true app-server --analytics-default-enabled

I did not find a second standalone Codex CLI process competing for the token during that reproduction.

Expected behavior

After a successful turn, Codex Desktop should remain authenticated and allow another turn.

Actual behavior

The turn itself completes successfully, but Desktop subsequently performs an auth refresh, receives refresh_token_invalidated, and returns to the ChatGPT sign-in screen.

The same account continues to work normally in Codex CLI.

I can provide additional sanitized logs_2.sqlite excerpts if useful.

I can reproduce this on Windows with a newer build.

Environment

Windows 11 x64
Microsoft Store package: OpenAI.Codex_26.818.2441.0_x64__2p2nqsd0c76g0
Codex CLI: 0.148.0-alpha.21
Desktop executable: ChatGPT.exe

Behavior

Browser OAuth completes successfully.
Codex Desktop initially reports:
authenticatedAccountPresent=true
A few seconds later, the first authenticated request to:
GET /backend-api/accounts/{account_id}/settings
returns HTTP 401.
Desktop log then reports:
hasToken=false
nullReason=auth_token_missing
refreshToken=true
tokenExpiryState=missing
The account lookup then changes to:
authenticatedAccountPresent=false
failureType=account_info_token_unavailable
The backend response is:
Missing valid access token or actor biscuit
The app returns to the sign-in flow.

CLI comparison

codex login status returns:
Logged in using ChatGPT
CLI authentication remains valid after 60+ seconds.
The CLI continues to work while the Desktop app loses authentication.

Troubleshooting already performed

Removed/renamed %USERPROFILE%\.codex\auth.json and performed a fresh OAuth login.
Cleared the Electron/Web profile.
Ran Reset-AppxPackage for OpenAI.Codex.
Verified no CODEX_ACCESS_TOKEN, OPENAI_API_KEY, OPENAI_BASE_URL, OPENAI_API_BASE, or CODEX_HOME environment variables are set.
Verified ChatGPT traffic is reachable through the configured proxy/TUN.
Repair and full MSIX reset did not resolve the issue.

The Desktop app still reproduces the same sequence after a full package reset:

authenticatedAccountPresent=true
→ /accounts/{account_id}/settings HTTP 401
→ auth_token_missing
→ account_info_token_unavailable

This appears to be Desktop-specific token/session handling, because the CLI remains authenticated using the same account.