Windows Desktop app repeatedly logs out after sending one message when Advanced Account Security is enabled (401 Missing valid access token or actor biscuit)

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #39581
• #39170
• #39491

Powered by Codex Action

I can consistently reproduce this issue on the Windows Codex/ChatGPT desktop app, and the behavior changes immediately depending on whether Advanced Account Security (AAS) is enabled.

AAS enabled

• Sign-in succeeds normally.
• The main interface loads correctly.
• However, opening any existing Project/thread immediately causes the app to lose the authenticated session and return to the login screen.
• The issue affects all Projects I tested, not just a specific Project or conversation.
• Re-authenticating does not solve the problem; opening a Project triggers the logout again.

AAS disabled

• Sign-in succeeds normally.
• All existing Projects and threads open correctly.
• Project files can be accessed and used normally.
• No unexpected logout or authentication loop occurs.

So in my environment, the comparison is very clear:

AAS enabled → opening any Project/thread triggers logout
AAS disabled → Projects and project files work normally

I did not need to reinstall the application, recreate the Projects, or change the project files. Simply disabling AAS restored normal behavior.

This strongly suggests that the issue is related to the authentication/session handling used by the Windows desktop app when Advanced Account Security is enabled, rather than corruption of an individual Project or local project data.

I can reproduce this issue consistently on the latest Windows desktop app version 26.820.7780.0.

Environment:

• ChatGPT Plus
• Windows 11 Pro 25H2
• OS Build 26200.9168
• Windows Feature Experience Pack 1000.26100.344.0

The login succeeds normally. My account, projects, and conversations load correctly.

However, after I open a new Work chat and send a message, the app suddenly loses authentication and returns to the “Sign in to ChatGPT” screen without displaying any error.

The ChatGPT web app works normally with the same account. This only happens in the Windows desktop app.

I also performed a complete clean reset:

• Reset and terminated the Windows app
• Completely uninstalled it
• Removed the entire .codex directory including auth.json, cap_sid, sessions, state, and local project metadata
• Removed OpenAI/Codex AppData
• Checked Windows Credential Manager
• Restarted Windows
• Reinstalled the latest version
• Signed in again from a completely fresh state

The first-time onboarding was shown again after reinstalling, confirming that the old local state had been removed.

Despite this, the logout issue still occurs.

I have also reproduced the issue in a screen recording. The recording shows a successful login, opening a Work chat, sending a message, and then the app automatically returning to the login screen approximately 50 seconds later with no visible error.

So this issue is still reproducible on 26.820.7780.0.

Update: account-session reset resolved the authentication loop in my environment

After further troubleshooting, I found an account-session reset that resolved the Windows Codex Desktop authentication loop in my environment.

Original failure

ChatGPT browser authentication completed successfully and the Codex Desktop UI initially appeared. However, sending a message or opening an existing project caused the app to receive a 401 response, lose its local authentication token, and return to the sign-in screen.

The relevant log sequence was:

hadToken=true
GET /backend-api/accounts/:param/settings -> 401
hasToken=false
auth_token_missing

The issue reproduced consistently after resetting the desktop profile, using a separate CODEX_HOME, and fully reinstalling the Windows package. The Codex IDE extension continued to work with the same ChatGPT account.

Workaround

1. Open the ChatGPT web application.
2. Open Settings → Security.
3. Locate the active login sessions/devices.
4. Select log out of all active sessions/devices.
5. Sign in to the Windows Codex Desktop app again using the normal ChatGPT browser-authentication flow.
6. Send a message and open an existing project to confirm that the desktop session remains authenticated.

Important: Logging out all active sessions signs the account out on other browsers and devices. Save in-progress work before doing this.

Verification completed

• [x] Fresh Codex Desktop login succeeded after all active sessions were logged out.
• [x] New chat messages could be sent without returning to the sign-in screen.
• [x] Existing projects and conversations opened normally.
• [x] Codex Desktop could be fully closed and reopened without recurrence.
• [x] Windows restarted without recurrence.
• [x] Normal operation remained stable after a subsequent Codex Desktop update.
• [x] ChatGPT web and mobile app sign-ins succeeded without disrupting the original Codex Desktop session.
• [x] Signing in on a separate PC did not disrupt the original Codex Desktop session.
• [x] Continued normal use did not reproduce the authentication loop.

Outcome log

| Date/time (JST) | Test | Result | Notes |
|---|---|---|---|
| 2026-08-27 | Logged out all active ChatGPT sessions, then signed in to Codex Desktop again | Pass | Immediate authentication loop no longer reproduced |
| 2026-08-27 | Sent messages and opened projects/conversations | Pass | No unexpected logout |
| 2026-08-27 | Full Codex Desktop restart | Pass | Authentication loop did not recur |
| 2026-08-27 | Windows restart | Pass | Codex Desktop remained operational after reboot |
| 2026-08-27 | Codex Desktop update followed by normal use | Pass | Continued working normally after the update |
| 2026-08-27 | Signed in through ChatGPT web and the mobile app | Pass | The original Codex Desktop session remained operational |
| 2026-08-27 | Signed in on a separate PC while continuing to use the original PC | Pass | Multi-device sign-in did not reproduce the authentication loop |

Why this result is significant

Desktop-side recovery steps did not resolve the issue, while invalidating all account sessions did. This suggests that stale or inconsistent account-side session state may have been involved rather than only local cache corruption or a damaged installation.

This does not establish the exact root cause. One possible interpretation is that the desktop authentication flow received credentials that were accepted during browser login but rejected by the subsequent account-settings request. Invalidating every active session may have forced the account and desktop app to establish a fully fresh session.

Relevant account context

The authentication loop began shortly after changes under the account's Security / Login settings, including adding a password and enabling SMS MFA. The timing does not prove causation, but it may be relevant to the account-side session state.

This should be treated as an account-specific workaround, not a universal fix. Similar-looking authentication failures may have different causes, and signing out all active sessions has not resolved every related report.

If the issue recurs, I will record the exact time, the operation immediately preceding the logout, whether the log again shows hadToken=true -> 401 -> hasToken=false, and whether the same account-session reset resolves it a second time.

Adding another independently reproduced data point for this issue.

I can reproduce the same Windows desktop authentication failure on a newer build, after enabling Advanced Account Security.

Environment

• Windows 11 x64
• Desktop package: OpenAI.Codex_26.820.9563.0_x64__2p2nqsd0c76g0
• Desktop runtime reported in logs: 26.820.71523
• Advanced Account Security enabled
• Authentication performed using a passkey stored in 1Password
• No VPN, proxy, or SSL inspection in use
• ChatGPT in the browser remains authenticated and works normally

Reproduction

I can trigger the failure in two different ways:

1. Sign in successfully, then open an existing conversation.
2. Sign in successfully, start a brand-new chat, send a simple test prompt, see the response begin generating, and then get returned to the Sign in to ChatGPT screen.

This does not appear to be a conventional process crash. The desktop process remains alive, but its usable ChatGPT authentication state is lost.

Captured auth sequence

authenticatedAccountPresent=true

desktop_fetch_auth_401 hadToken=true
GET /backend-api/accounts/:param/settings

hasToken=false
nullReason=auth_token_missing
refreshToken=true

401
"Missing valid access token or actor biscuit"

authenticatedAccountPresent=false
failureType=account_info_token_unavailable

After the first 401, subsequent requests are made with hadToken=false / no_token_attached and continue returning 401s.

The timing is notable because this began shortly after Advanced Account Security was enabled. I am treating that as correlation rather than proof of root cause, but the failure signature closely matches the original report here.

I also captured screenshots and a sanitized diagnostic evidence packet containing the package/build information, PowerShell output, and the full auth-failure sequence. Personal/account identifiers, local usernames, conversation titles, request/session IDs, UUIDs, and other unnecessary correlation metadata were redacted from the public copy.

ChatGPT_Windows_Desktop_Auth_Evidence_2026-08-27_PUBLIC_REDACTED.pdf

Update: account-wide session reset appears to resolve the loop on Windows 26.820.9563.0

Following the workaround reported above, I tested an account-wide session reset on the same Windows machine where I had previously captured the reproducible auth failure.

Procedure used:

1. Opened ChatGPT Web → Settings → Security.
2. Chose Log out of all active sessions/devices.
3. Fully quit the Windows desktop app.
4. Signed back into the desktop app using the normal browser flow with my passkey.
5. Tested both a new chat and an existing conversation.

Result: the authentication loop appears to be resolved so far. The desktop app remains signed in instead of falling back to the login screen after conversation activity.

Environment is unchanged from my earlier report:

• Windows 11 x64
• OpenAI.Codex_26.820.9563.0_x64__2p2nqsd0c76g0
• Desktop runtime 26.820.71523
• Advanced Account Security enabled
• Authentication via passkey stored in 1Password
• No VPN, proxy, or SSL inspection

Before the reset, the failure was consistently:

authenticatedAccountPresent=true
→ desktop_fetch_auth_401 hadToken=true
→ hasToken=false / auth_token_missing
→ Missing valid access token or actor biscuit
→ authenticatedAccountPresent=false

The fact that desktop-side resets/reinstalls were not required, while invalidating all account sessions changed the behavior, makes stale or inconsistent account-side session state a plausible factor. This is only a workaround/observation, not proof of root cause.

I’ll continue using the app normally and will update again if the failure returns.