[Windows app 26.727] "refresh token was already used" persists after logout, deleting auth.json, and signing in again

What version of the Codex App are you using?

Codex 26.727

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Windows x64

What issue are you seeing?

The Codex Windows app fails on every prompt with the following authentication error:

Your access token could not be refreshed because your refresh token was already used. Please log out and sign in again.

The recovery instruction does not work. I logged out, completely closed the app, deleted the local authentication file below, reopened Codex, and signed in again:

%USERPROFILE%\.codex\auth.json

A new authentication file was created after signing in, but the app immediately returned the same error. Codex remains unusable.

At the same time, another client authenticated with the same OpenAI account started returning HTTP 401. This may indicate that the newly issued session is being invalidated or that Codex is restoring/reusing a stale refresh token after login.

What steps can reproduce the bug?

1. Open Codex for Windows and sign in with ChatGPT.
2. Send any prompt.
3. Observe the refresh token was already used error.
4. Log out of Codex.
5. Fully close the application.
6. Delete %USERPROFILE%\.codex\auth.json.
7. Reopen Codex and complete a new login.
8. Send another prompt.
9. The same error appears again immediately.

What is the expected behavior?

Logging out and signing in again should create a clean OAuth session and make Codex usable. Deleting the local authentication file before signing in should prevent the app from restoring or reusing an invalid refresh token.

What is the actual behavior?

Codex continues to report that the refresh token was already used even after a complete logout, removal of the local authentication file, and a fresh login. There is no working recovery path in the app.

Additional information

This appears related to the previously closed issue #9634 and the current Windows reports #25599 and #25379, but it is still reproducible on version 26.727 after performing the documented logout/login recovery steps.