Codex Windows: fresh OAuth refresh token immediately invalidated when two ChatGPT accounts are signed in on the web

What version of the Codex App are you using (From “About Codex” dialog)?

26.814.5167.0

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Codex Desktop on Windows repeatedly logged me out immediately after the first successful prompt.

The initial OAuth login succeeded, a new Codex conversation could be created, and the first model response was returned successfully. Immediately afterwards, Codex performed an auth refresh and the OpenAI OAuth endpoint rejected the refresh token with:

401 Unauthorized

Your refresh token has been invalidated. Please try signing in again.

code: refresh_token_invalidated

After extensive troubleshooting, the issue appears to be related to having two ChatGPT accounts simultaneously signed in in the browser using ChatGPT's web account switching feature.

After signing out of the ChatGPT accounts in the browser and clearing that multi-account browser session, Codex Desktop started working normally again.

Environment
OS: Windows 11 Pro, build 26200, x64
Device: Windows PC
Codex / unified ChatGPT Desktop package:
OpenAI.Codex_26.814.5167.0_x64__2p2nqsd0c76g0
Codex Desktop client version reported in logs:
26.814.41407
Authentication: ChatGPT account / OAuth
Same OpenAI account works correctly:
on another Windows 11 PC
on smartphone
in a newly created local Windows user profile on the affected PC
Reproduction / observed behavior
Have two different ChatGPT accounts signed in simultaneously in the browser using ChatGPT web account switching.
Start Codex Desktop on Windows.
Sign in to the desired ChatGPT account.
OAuth login completes successfully.
Create a new Codex conversation.
Send a simple prompt such as hi.
Codex successfully returns the first model response.
Immediately afterwards, Codex logs the user out and displays the OpenAI login screen again.

The problem can be repeated indefinitely.

Relevant log sequence

Codex successfully loads the account:

Reloading auth for account <redacted>
Reloaded auth, changed: false
Refreshing token

The first refresh request then fails:

POST https://auth.openai.com/oauth/token
status=401 Unauthorized

OpenAI returns:

{
"error": {
"message": "Your refresh token has been invalidated. Please try signing in again.",
"type": "invalid_request_error",
"param": null,
"code": "refresh_token_invalidated"
}
}

Example failed OAuth request ID:

48ebe85a-6f87-4052-8afc-56230361abfa
Important diagnostic detail

The refresh token stored in:

%USERPROFILE%\.codex\auth.json

was fingerprinted with SHA-256 immediately after a fresh successful login and again immediately after Codex logged out.

The SHA-256 fingerprint, file modification timestamp, and last_refresh value were identical before and after the failure.

Therefore, the local auth.json refresh token was not modified or rotated by another local process during the observed failure.

The first visible refresh attempt in the Codex logs was already rejected by the server as refresh_token_invalidated.

At the same time, the access token remained valid long enough for the first Responses API request to complete successfully.

Troubleshooting already performed

The following did NOT fix the problem:

Signed out and signed back in repeatedly
Deleted/recreated auth.json
Completely removed the existing .codex directory
Started Codex with a completely fresh .codex state
Uninstalled and reinstalled Codex Desktop
Reset the Windows MSIX package
Removed the npm Codex CLI
Removed the previous ChatGPT Classic Windows application
Verified no CODEX_HOME override existed
Verified no OPENAI_, CHATGPT_, or proxy environment variables existed
Verified Windows Credential Manager contained no OpenAI/Codex/ChatGPT credential
Verified there was no second Codex process running under the affected Windows user
Tested after logging out all other Windows user sessions
Tested with a completely new local Windows user profile

The new local Windows user profile worked correctly with the exact same OpenAI account on the exact same machine.

This strongly isolated the problem to authentication/session state associated with the original Windows/browser user environment rather than the OpenAI account, network, machine, or subscription.

Additional Windows diagnostics

The affected Windows profile initially showed:

WamDefaultSet : ERROR (0x80070520)

and Windows AAD logs repeatedly contained:

0xCAA100D8
A login hint was sent that doesn't match any WebAccount in the system.

After correcting/reinitializing the Windows login state, dsregcmd /status changed to:

WamDefaultSet : YES
WamDefaultAuthority : consumers
WamDefaultId : https://login.microsoft.com
WamDefaultGUID : MicrosoftAccount

However, this did NOT fix the Codex refresh-token failure, so the WAM issue appears to have been secondary rather than the root cause.

What finally changed the behavior

The affected browser had two ChatGPT accounts simultaneously signed in.

When signing out in ChatGPT Web, the UI explicitly asked which of the two accounts should be signed out, confirming that both accounts were active in the same browser session.

After signing out / clearing this multi-account ChatGPT browser login state, Codex Desktop started working normally.

No additional Codex reinstall or .codex reset was required at that point.

Suspected root cause

There appears to be an interaction between:

ChatGPT Web multi-account switching/session state
Codex Desktop OAuth login
refresh-token issuance or invalidation

A possible failure mode is that Codex Desktop successfully obtains an access/refresh token pair for the selected account, but the browser's multi-account OpenAI authentication state subsequently causes the refresh-token family/session to be replaced or invalidated.

This would explain why:

OAuth login succeeds.
The access token works for the first model request.
The locally stored refresh token remains unchanged.
The first later refresh attempt is already rejected server-side as invalidated.
Expected behavior

Codex Desktop authentication should be isolated from unrelated secondary ChatGPT accounts signed in through the ChatGPT Web account switcher.

If Codex Desktop does not support account switching, the OAuth flow should explicitly bind to the selected account and should not issue a refresh token that becomes invalid because another ChatGPT account is active in the browser session.

At minimum, Codex should detect this condition and present an actionable error instead of repeatedly asking the user to sign in again.

Related context

OpenAI documentation currently states that account switching is supported in ChatGPT Web but not yet in Codex Desktop.

There are also existing Codex Windows authentication reports involving freshly recreated authentication state and refresh tokens that are immediately considered used/revoked/invalid.

This report may therefore be another manifestation of the same underlying account-session / refresh-token handling issue, specifically triggered by ChatGPT Web multi-account sessions.

What steps can reproduce the bug?

1. On Windows 11, sign in to ChatGPT Web with account A.
2. Use ChatGPT's account switching feature to also sign in with account B, so both accounts are simultaneously active in the same browser session.
3. Start Codex Desktop.
4. Sign in to Codex using account B.
5. The OAuth login completes successfully.
6. Create a new Codex conversation.
7. Send a simple prompt such as "hi".
8. Codex successfully returns the first model response.
9. Shortly afterwards Codex performs getAuthStatus / OAuth token refresh.
10. The refresh request to https://auth.openai.com/oauth/token returns:

401 Unauthorized
code: refresh_token_invalidated

1. Codex immediately logs out and displays the OpenAI login screen again.

The cycle can be repeated indefinitely:
login -> first response works -> refresh_token_invalidated -> logout.

WORKAROUND / IMPORTANT REPRODUCTION DETAIL:

Sign out of BOTH ChatGPT accounts in the browser and remove the multi-account browser session. Then sign in with only the account intended for Codex.

After doing this, Codex Desktop works normally again.

What is the expected behavior?

Codex Desktop should remain authenticated after a successful OAuth login.

Having another ChatGPT account simultaneously signed in through ChatGPT Web account switching should not invalidate the refresh token issued to Codex Desktop.

If Codex Desktop does not support multi-account sessions, the OAuth flow should explicitly require/select one account or display an actionable error instead of entering an endless:

login -> successful first response -> logout -> login

cycle.

Additional information

This was extensively isolated before reporting.

The same OpenAI account works correctly:

• on another Windows 11 PC,
• on a smartphone,
• and on the SAME affected PC under a newly created local Windows user profile.

A clean Codex installation did not fix the issue:

• Codex Desktop completely uninstalled/reinstalled
• MSIX package reset
• old .codex directory removed
• fresh .codex profile created
• npm Codex CLI removed
• ChatGPT Classic removed
• no CODEX_HOME override
• no OPENAI/CHATGPT/CODEX environment variables
• no OpenAI/Codex credentials in Windows Credential Manager
• other Windows user sessions logged out

The refresh_token in .codex/auth.json was SHA-256 fingerprinted immediately after successful login and again immediately after the forced logout.

The fingerprint, auth.json modification timestamp, and last_refresh value were identical before and after the failure.

Therefore the locally stored refresh token was NOT modified or rotated during the failure.

The first visible refresh attempt was already rejected by the OpenAI OAuth server with refresh_token_invalidated.

Example failed OAuth request ID:

48ebe85a-6f87-4052-8afc-56230361abfa

The access token remains valid long enough for the first Responses API request to succeed.

The issue disappeared only after signing out of the two simultaneously active ChatGPT Web accounts and clearing the multi-account browser session.