Windows desktop app loses ChatGPT authentication within 15–40 seconds after enabling Advanced Account Security; Codex CLI remains logged in

Open 💬 17 comments Opened Aug 18, 2026 by liuyangyi0

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

Summary

On Windows, the Codex/ChatGPT desktop app successfully signs in with ChatGPT, but loses the authenticated account state within approximately 15–40 seconds and returns to a signed-out state.

Important additional trigger/context: this started after I enabled Advanced Account Security on my OpenAI/ChatGPT account. I did not see this behavior before enabling that setting. I cannot prove that Advanced Account Security is the root cause, but the timing is strong enough that it may be relevant to the desktop authentication regression.

The same ChatGPT account remains authenticated and works normally in:

ChatGPT Web
Codex CLI

The issue is consistently reproducible in the Windows desktop app.

Environment

OS: Windows
Desktop package: OpenAI.Codex 26.814.5167.0
Authentication method: Sign in with ChatGPT
Account setting changed shortly before issue began: Advanced Account Security enabled
Codex CLI: authenticated and working normally with the same account

codex login status after the desktop app has already lost authentication still reports:

Logged in using ChatGPT

Reproduction steps

Enable Advanced Account Security on the ChatGPT/OpenAI account.
Launch the Windows Codex/ChatGPT desktop app.
Sign in with ChatGPT in the browser flow.
Return to the desktop app.
Authentication initially succeeds.
Wait roughly 15–40 seconds.
The desktop app loses the authenticated account and returns to a login state.
Signing in again creates another Codex session, but the same failure repeats.

Relevant desktop log evidence

Immediately after sign-in:

[chatgpt-account-lookup] ...
authenticatedAccountPresent=true
authMethod=chatgpt
failureType=undefined
result=succeeded

About 15–40 seconds later:

[chatgpt-account-lookup] ...
authenticatedAccountPresent=false
authMethod=chatgpt
failureType=account_info_token_unavailable
result=failed

Immediately afterwards, authenticated desktop requests fail with 401:

status=401
{"detail":"Missing valid access token or actor biscuit"}

and:

status=401
{"detail":"Unauthorized"}

This cycle repeats after every re-login.

Examples observed in one session:

Authentication succeeded at 07:15:26Z, became account_info_token_unavailable at 07:16:03Z (~37 seconds)
Authentication succeeded at 07:17:00Z, failed at 07:17:16Z (~16 seconds)
Authentication succeeded at 07:23:35Z, failed at 07:24:18Z (~43 seconds)
Authentication succeeded at 07:28:33Z, failed at 07:28:57Z (~24 seconds)

Troubleshooting already performed

Signed out of all active sessions and signed in again
Reset the Windows desktop app
Fully uninstalled the desktop app
Rebooted Windows
Reinstalled the desktop app
Removed third-party Ark CLI injected Codex skills (arkcli +connect uninstall)
Verified only one codex.exe app-server process was active during testing
Verified ChatGPT Web stays logged in normally
Verified Codex CLI stays logged in and works normally using the same ChatGPT account

The problem still reproduces after all of the above.

Expected behavior

After successful ChatGPT authentication, the Windows desktop app should keep the authenticated account state and continue using the valid session, including when Advanced Account Security is enabled.

Actual behavior

The desktop app loses the account token/state within less than one minute:

authenticatedAccountPresent=true
→ account_info_token_unavailable
→ authenticatedAccountPresent=false
→ HTTP 401
→ signed-out UI

Meanwhile, Codex CLI continues to work normally with the same account.

Related issue

The duplicate detector suggested #39162. That report is on macOS and is triggered by opening an existing conversation after a desktop update, but its auth failure sequence is notably similar (auth_token_missing / account_info_token_unavailable / HTTP 401). This Windows report differs in that the desktop app loses authentication on its own within 15–40 seconds, and the issue began after enabling Advanced Account Security.

I can provide additional redacted desktop logs if needed.

View original on GitHub ↗

17 Comments

github-actions[bot] contributor · 10 days ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#39162

Powered by Codex Action

anthonyprintup · 10 days ago

I can independently reproduce this issue on Windows with the same Desktop package and Advanced Account Security enabled.

### Environment

Desktop package: OpenAI.Codex 26.814.5167.0
Bundled app-server: 0.148.0-alpha.15
Standalone Codex CLI: 0.147.0
Authentication method: Sign in with ChatGPT
Advanced Account Security: enabled

### Controlled isolation

I fully stopped the packaged Desktop processes and moved only the following items to backups:

~/.codex/auth.json
The Electron Default browser profile

I did not modify or remove sessions, archived sessions, attachments, session indexes, thread-history databases, or state databases.

Desktop created a completely fresh browser profile, and the browser OAuth flow issued new, non-expired access and refresh tokens. The failure still
reproduced approximately 15 seconds after successful login.

The same newly issued authentication successfully completed an ephemeral Codex CLI request. This suggests that general Codex authentication remains
functional and that the failure is specific to the Desktop ChatGPT account/conversation layer.

### Sanitized UTC sequence

``text 10:00:54.711 account_login_completed success=true 10:00:55.967 authenticatedAccountPresent=true result=succeeded 10:01:06.527 conversation_inaccessible while opening/sending the conversation 10:01:09.438 desktop_fetch_auth_401 hadToken=true target=/accounts/:param/settings 10:01:09.703 hasToken=false nullReason=auth_token_missing refreshToken=true tokenExpiryState=missing 10:01:09.724 authenticatedAccountPresent=false failureType=account_info_token_unavailable 10:01:09.764 status=401 "Missing valid access token or actor biscuit"``

The system clock was correct, no Windows or WinHTTP proxy was active, and no relevant hosts-file overrides were present.

This clean-profile reproduction appears to rule out stale Electron state and a stale local OAuth token. No token material, account identifiers,
conversation identifiers, chat contents, or identifying local paths are included here. I can provide additional redacted logs privately if useful.

_Disclosure: This comment was generated by OpenAI Codex from redacted diagnostic evidence collected on my machine._

jacob-hartmann · 9 days ago

I am experiencing the same issue with the newest update of ChatGPT app and Advanced Security enabled, however I am only kicked out of the desktop app when I access a newly or previously completed thread. For example, if I start a new thread, I am able to view it running (potentially for hours), but once it's finished, it kicks me out. If I navigate to other aspects of the ChatGPT app besides a new thread, there is no recurrence.

I do not believe this is fully related to the multi-session bugs that are cross-linked to this issue chain.

Unfortunately the CLI is also impacted. Attempting to resume a thread simply signs me out in a similar manner as the desktop app. I believe this is a new server-side issue with how OpenAI is handling authentication with Advanced Security users.

rmreynolds · 8 days ago

I have this same issue. Reported feedback id: no-active-thread-01a01be6-1ac1-7480-93c1-945056b56bfd

ztdan4ik · 8 days ago

I can reproduce a very similar issue on macOS, and I found a workaround that may help identify the root cause.

Environment:

macOS / Apple Silicon
Codex Desktop 26.814.41407
ChatGPT authentication
The issue started immediately after I enabled Advanced Account Security. Codex Desktop had been working normally before that, and the desktop client had not been updated when the problem started.

Symptoms:

Codex Desktop initially authenticated successfully and displayed my conversations.
Opening a conversation caused authentication to be lost.
I later tested with a newly created conversation as well: the model started responding successfully, but the app then signed out.
Disabling Advanced Account Security did NOT fix the issue.
Removing ~/.codex/auth.json and performing a fresh Codex login did NOT fix it.
Removing the Codex browser extension did NOT fix it.

The Codex logs showed:

Failed to refresh token: 401 Unauthorized

"message": "Your refresh token has been invalidated. Please try signing in again."
"code": "refresh_token_invalidated"

and requests to Codex endpoints subsequently returned:

Encountered invalidated oauth token for user
code: token_revoked

Interestingly, the Codex Responses WebSocket initially connected successfully and the model was able to start generating a response before the refresh token became invalidated.

What finally fixed the problem:

Quit Codex Desktop completely.
Signed out of ChatGPT in the browser used for the Codex OAuth flow.
Closed/restarted the browser.
Signed back into ChatGPT in the browser.
Started Codex Desktop and authenticated again.

After refreshing the browser-side ChatGPT session this way, Codex Desktop started working normally again.

So in my case, enabling Advanced Account Security appears to have left the existing browser/OpenAI session in a state where newly issued Codex OAuth credentials would subsequently be invalidated. Simply disabling Advanced Account Security or re-authenticating Codex itself was not sufficient; refreshing the browser-side ChatGPT session was required.

This may indicate an interaction between Advanced Account Security, the existing ChatGPT browser session, and the Codex OAuth/device authorization flow.

heyobravo · 8 days ago

Independent macOS reproduction with sanitized diagnostics.

Environment

ChatGPT/Codex desktop: 26.814.41407 (build 6720)
Platform: Darwin 27.0.0 arm64
Authentication: browser-based “Sign in with ChatGPT”
Advanced Account Security was enabled immediately before the problem began

Reproduced sequence

01:29:54Z login completed successfully
01:29:58Z refresh token invalidated

01:30:42Z login completed successfully
01:30:48Z refresh token invalidated

01:44:46Z login completed successfully
01:44:56Z refresh token invalidated

After each browser login:

The OAuth callback reports success=true.
The desktop app initially reports authenticatedAccountPresent=true.
Opening or resuming a conversation triggers an authenticated request to /backend-api/accounts/:account_id/settings.
That request returns HTTP 401.
The subsequent token refresh is rejected with:

Your refresh token has been invalidated. Please try signing in again.
code: refresh_token_invalidated

The app transitions to auth_token_missing, reports authenticatedAccountPresent=false, and returns to the login screen.

The newly issued access token had an expiration approximately ten days in the future, so it was not naturally expired. The credential store was successfully rewritten at login with restrictive permissions, which indicates that the browser callback and local credential persistence both worked. The first subsequent refresh was rejected server-side.

No tokens, account identifiers, conversation identifiers, local paths, or raw log archives are included. Additional redacted evidence can be provided privately if needed.

_This comment was prepared with OpenAI Codex from redacted diagnostic evidence collected on my machine._

Confirmed workaround

The workaround described in this macOS comment fixed the issue for me as well:

Quit the ChatGPT/Codex desktop app completely.
Sign out of ChatGPT in the browser used for the desktop OAuth flow.
Close and restart that browser.
Sign back into ChatGPT in the browser.
Start the desktop app and authenticate again.

After refreshing the browser-side ChatGPT session, the desktop app remained signed in and I could open chats normally. The issue has not reproduced since.

This further supports an interaction between Advanced Account Security, the pre-existing ChatGPT browser session, and the desktop OAuth refresh-token lifecycle.

oscarcs · 8 days ago

Same issue here on macOS. Enabled Advanced Account Security today. Seems like simultaneously being logged in on web is causing issues as other reporters note.

Current app version: 26.814.41957 (build 6744) macOS

Interestingly, Check for Updates currently reports:

ChatGPT 26.814.41407 is currently the newest version available.
(You are currently running version 26.814.41957.)

I've also tried:

Fully uninstalling/reinstalling the desktop app
Clearing/moving the com.openai.codex / Codex application support, cache, and preference state
Re-authenticating

with no luck

aminya · 8 days ago

1. Quit Codex Desktop completely. 2. Signed out of ChatGPT in the browser used for the Codex OAuth flow. 3. Closed/restarted the browser. 4. Signed back into ChatGPT in the browser. 5. Started Codex Desktop and authenticated again. After refreshing the browser-side ChatGPT session this way, Codex Desktop started working normally again.

I had the same issue, and this fixed it. Seems like a disagreement between the browser and the desktop app

anthonyprintup · 8 days ago

> 1. Quit Codex Desktop completely. > 2. Signed out of ChatGPT in the browser used for the Codex OAuth flow. > 3. Closed/restarted the browser. > 4. Signed back into ChatGPT in the browser. > 5. Started Codex Desktop and authenticated again. > > After refreshing the browser-side ChatGPT session this way, Codex Desktop started working normally again. I had the same issue, and this fixed it. Seems like a disagreement between the browser and the desktop app

Steps 2. and 4. also fixed the issue for me.

CassandraVrinn · 6 days ago

I am experiencing what appears to be the same authentication regression on Windows, and I found a Stable/Beta comparison that may help narrow down the issue.

I am currently using Codex Desktop Stable build 26.818.41509 with ChatGPT authentication. On this build, authentication initially succeeds and Codex can start working normally. However, after completing a turn, the app frequently loses the authenticated state and asks me to sign in again.

The behavior is very consistent: I sign in successfully, send a prompt, Codex completes the response, and then the desktop app asks me to authenticate again. Signing in again temporarily restores access, but the same problem can happen again after another completed turn.

I then switched to the Beta version available on the same machine. The Beta version I have was last updated on July 31, so it appears to be older than the current Stable build.

I have now tested the Beta version across multiple consecutive turns and have not encountered the authentication problem at all. Authentication remains stable and I can continue using Codex normally without repeatedly signing in.

The test conditions are otherwise the same: same Windows machine, same ChatGPT account, same network, same projects, and the same general development environment. The main variable I changed was the Codex Desktop build.

So my current results are:

Stable 26.818.41509: repeatedly loses authentication after completed turns.

Beta, July 31 build: tested across multiple turns with no authentication loss.

This makes me suspect that the issue may be a regression introduced in a newer Stable Desktop build rather than an account-wide authentication problem.

There is one additional observation that may or may not be related. In both Stable and Beta, I occasionally see the following streaming error:

stream disconnected before completion: IO error: peer closed connection without sending TLS close_notify

Codex then attempts to reconnect automatically, for example showing “reconnecting 2/5”.

However, I do not currently think this streaming error directly explains the authentication problem, because I can reproduce the TLS/stream disconnect on Beta as well, while Beta continues to remain authenticated normally. Stable can lose authentication, whereas Beta does not, even though both versions can encounter this network error.

The local authentication process also appears to complete successfully initially, so the failure seems to happen after a successful login rather than during the initial authentication flow.

I have intentionally not included any authentication tokens or credential files for security reasons.

For now, using the older Beta build is a reliable workaround for me.

If useful for debugging, I can provide exact package information, timestamps, sanitized logs, or perform additional Stable/Beta reproduction tests.

Hopefully this comparison helps narrow down the regression window.

One additional difference from #39696: I do not have Advanced Account Security enabled on my account. I can still reproduce the same Stable authentication failure while Beta remains stable. This suggests that Advanced Account Security may not be a required trigger for the issue.

itsluzby · 5 days ago

I can reproduce this issue on a newer Windows desktop build:

Desktop package: OpenAI.Codex 26.818.5229.0
Authentication: ChatGPT account with Advanced Account Security enabled
Authentication method: YubiKey / FIDO2 security key

The sign-in flow itself completes successfully. The app initially recognizes the authenticated account, but loses the access token shortly afterwards and returns to the sign-in screen.

Relevant redacted log sequence:

[chatgpt-account-lookup]
authenticatedAccountPresent=true
authMethod=chatgpt
failureType=undefined
result=succeeded

Then shortly afterwards:

desktop_fetch_auth_401 hadToken=true

followed by:

app_server_connection.auth_status_result
authMethod=chatgpt
hasToken=false
nullReason=auth_token_missing
refreshToken=true
tokenExpiryState=missing

and:

[chatgpt-account-lookup]
authenticatedAccountPresent=false
authMethod=chatgpt
failureType=account_info_token_unavailable
result=failed

The underlying auth manager also reports:

Failed to refresh token: 401 Unauthorized

Your refresh token has been invalidated. Please try signing in again.

code: refresh_token_invalidated

After that, desktop API requests consistently fail with:

401 Unauthorized
Missing valid access token or actor biscuit

Re-authenticating with the YubiKey succeeds again, but the same sequence repeats.

In one reproduction:

13:24:10.826Z account_login_completed success=true
13:24:12.105Z authenticatedAccountPresent=true
13:24:21.085Z hasToken=false nullReason=auth_token_missing
13:24:21.154Z authenticatedAccountPresent=false failureType=account_info_token_unavailable

So in this case the authenticated state survived for only about 9 seconds.

Troubleshooting already performed:

Windows desktop app reset
Complete uninstall
Windows reboot
Reinstall of the new ChatGPT/Codex desktop app
Previous ChatGPT Classic installation removed
Repeated authentication using the YubiKey

The issue persists.

ChatGPT Web works normally with the same account.

This therefore appears to still be present in 26.818.5229.0, and the logs strongly suggest that the desktop client loses/invalidates its refresh/access-token state after an otherwise successful AAS/FIDO2 login.

I can provide the complete redacted desktop log if useful.

piwanczak · 5 days ago

Same for me. What's curious is codex cli seems to work still -i.e. remote sessions allow me to drive chatgpt app from mobile.

This is a major blocker for me as I believe is for others.
Military acronym - Charlie foxtrot :(

kanewong1028 · 5 days ago

Independent Windows reproduction with a task-page-specific variant.

Environment

Desktop package: OpenAI.Codex 26.818.4152.0
Authentication: Sign in with ChatGPT
Mobile Remote continues to work with the same account/session
Desktop sign-in completes successfully

Observed behavior

Selecting a task in the Windows desktop app redirects to the sign-in page. Completing the browser sign-in succeeds, but selecting the task repeats the same login flow.

The local credential cache contains newly issued, non-expired access and refresh tokens. A read-only request to the tasks endpoint using the same access token returns HTTP 200, while the desktop renderer's own request fails with HTTP 401 and logs:

desktop_fetch_auth_401 hadToken=false skipRetryReason=no_token_attached
app_server_connection.auth_status_result hasToken=false nullReason=auth_token_missing refreshToken=true tokenExpiryState=missing

This suggests the desktop task-page request path is not attaching the available token, rather than the account credential being invalid.

Troubleshooting already completed

Full uninstall/reinstall on the previous day
Fresh browser sign-in
Electron cookies/local/session storage rebuilt
Codex authentication cache rebuilt
Both OS credential-store and file-based credential storage tested
Desktop/app data normalized to one drive
Single desktop root instance verified
System-proxy and direct network reachability both tested; no proxy/tunnel authentication errors found
No newer Microsoft Store package is currently offered

The issue remains reproducible. No tokens, account IDs, task IDs, request IDs, usernames, or local paths are included here.

_Disclosure: This comment was prepared by OpenAI Codex from redacted diagnostic evidence collected on the user's machine, with the user's approval for public submission._

2666fff · 4 days ago

I’d like to describe the similar issue I’m experiencing:

I enabled the Advanced Security feature on my account while using the 20x Pro plan.

After that, I noticed that in the Windows stable version, whenever I click into a completed conversation, the app immediately asks me to re-authorize through the web browser.

I disabled the Advanced Security feature right away, but it did not help. The issue still occurs: as soon as I open a completed conversation, the authorization is immediately lost and I’m asked to sign in/authorize again.

On the official website, under Active Sessions, I can see around 8–9 active sessions, but in reality these appear to be sessions created because the Windows app repeatedly loses authorization and forces a new login.

qiankun229 · 3 days ago

I can confirm that this issue still reproduces on a newer Windows package.

Environment:

Windows 10 22H2, build 19045, x64
Microsoft Store package: OpenAI.Codex_26.818.8289.0_x64
Internal release reported in the desktop log: 26.818.61809
ChatGPT web and the standalone Codex CLI remain authenticated and fully functional with the same account

Trigger:

Launch the desktop app and complete ChatGPT sign-in.
Select an existing conversation from the history/sidebar.
The conversation route opens, but the app returns to the sign-in screen approximately 12 seconds later.

Sanitized timeline from the latest reproduction:

14:24:55  Existing conversation route opened
14:25:03  GET /backend-api/accounts/:param/settings
          -> 401, hadToken=true, tokenSource=cached, willRetry=true
14:25:05  hasToken=false, nullReason=auth_token_missing,
          refreshToken=true, tokenExpiryState=missing
14:25:07  authenticatedAccountPresent=false,
          failureType=account_info_token_unavailable
14:25:07  Retried account settings request:
          401 "Missing valid access token or actor biscuit"

Subsequent requests are sent with hadToken=false and fail with Unauthorized.

This also reproduced on the previous package version 26.818.5229.0. Updating to 26.818.8289.0, resetting the Windows app, isolating the Chromium profile/cache, and testing different proxy/TUN configurations did not resolve it.

The failure appears to be the same authentication-state transition described here and in #39803: opening an existing conversation triggers an account-settings request, one 401 changes the desktop state to auth_token_missing, and the app signs out instead of preserving or refreshing the existing credential.

No account ID, email address, conversation ID, token, or unredacted log is included.

machinae · 17 hours ago

Confirm same issue happening on mac. Desktop app is completely broken with advanced security.

ppbbii · 16 hours ago

On Windows it does not get fixed with disabling AAS - still broken.
Downgrading app to https://persistent.oaistatic.com/codex-app-prod/releases/26.803.10989.0/ChatGPT-x64.msix - fixes.
This looks to me a clear regression introduced around after this version. Would be lovely to hear from someone from Codex team