ChatGPT Desktop 26.818.41705: valid OAuth token rejected with 401 "Missing valid access token or actor biscuit" on every session, started immediately after auto-update

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #40138
• #40074
• #39925
• #40029

Powered by Codex Action

I can independently reproduce what appears to be the same authentication failure on ChatGPT Desktop for macOS.

Environment

• macOS
• ChatGPT Desktop version: 26.818.41705
• Bundle ID: com.openai.codex
• Auth mode: chatgpt

Symptom

Login succeeds normally. After starting or using a conversation, the app shows “Reconnecting…” and then returns to the login screen.

The failure is reproducible.

Important detail: the access token is not expired

Immediately after a successful login, I inspected the locally stored JWT metadata without printing the token itself:

auth_mode: chatgpt
last_refresh: 2026-08-25T05:28:01.817352Z
iat: 2026-08-25T05:28:01+00:00
exp: 2026-09-04T05:28:01+00:00
iss: https://auth.openai.com
aud: ['https://api.openai.com/v1']

So the access token had just been issued and still had approximately 10 days of validity remaining.

However, the desktop log shows the following sequence shortly afterwards:

2026-08-25T05:28:01.852Z
account_login_completed ... success=true

About 1 minute 43 seconds later:

2026-08-25T05:29:44.606Z
desktop_fetch_auth_401
hadToken=true
target="GET https://chatgpt.com/backend-api/accounts/:param/settings"
tokenSource=cached
willRetry=true

Then:

2026-08-25T05:29:46.202Z
app_server_connection.auth_status_result
authMethod=chatgpt
hasToken=false
nullReason=auth_token_missing
refreshToken=true
tokenExpiryState=missing

Immediately afterwards, requests are made without an attached token:

desktop_fetch_auth_401
hadToken=false
skipRetryReason=no_token_attached

and:

status=401
errorMessage="{\"detail\":\"Missing valid access token or actor biscuit\"}"

This produces the visible sequence:

Successful login
→ fresh valid token issued
→ /backend-api/accounts/.../settings returns 401 while hadToken=true
→ client auth state becomes auth_token_missing
→ subsequent requests no longer attach a token
→ app shows Reconnecting
→ app returns to login screen

Network checks

I also tested the network path separately:

• ws.chatgpt.com:443 successfully establishes an HTTP CONNECT tunnel through the proxy
• TLS 1.3 handshake succeeds
• certificate validation succeeds
• HTTP/2 negotiation succeeds
• chatgpt.com:443 also establishes successfully
• proxy exit IP remained identical across 10 consecutive checks

So this does not appear to be caused by a changing proxy exit IP or a basic TLS/connectivity failure.

I also confirmed that ~/.codex/auth.json is being updated after authentication, so in my case this is not simply a situation where the auth file is never written.

The key behavior seems to be that a valid authenticated state exists, /backend-api/accounts/.../settings receives a 401, and the desktop client subsequently transitions from hadToken=true to auth_token_missing, despite the freshly issued access token being far from expiration.

This looks very similar to the authentication-state regression reported in this issue.

Workaround that fixed the older-task logout loop for me

I had the same issue: new tasks worked, but opening an older codex://threads/... task immediately logged me out.

What I verified

I reproduced and investigated this across four different older tasks:

• The older tasks and their local transcripts were still intact.
• The local task database passed its integrity checks.
• The codex:// handler was registered correctly.
• The app successfully resumed the task first: thread/resume returned errorCode=null.
• Immediately afterward, authentication failed with 401 Unauthorized and refresh_token_invalidated.

This suggests the logout was caused by stale or invalid desktop authentication—not corrupted older tasks.

What fixed it for me

1. Open chatgpt.com in your browser.
2. Open the profile menu and fully Log out, then confirm.

Be aware that this can also sign you out of other ChatGPT sessions.

1. Return to the Codex/ChatGPT Mac app.
2. Click Sign in another way.
3. Choose Email and sign in directly using the email address connected to your ChatGPT account. Do not use Google, Apple, or another social-login option.
4. Enter the email verification code if requested.
5. On the Sign in to Codex with ChatGPT page, explicitly select the workspace containing the affected older tasks. In my case, this was Personal account. My personal and company workspace both use the same email address.
6. Click Continue/Open ChatGPT, return to the desktop app, and try opening the older tasks again.

After the full browser logout and direct email sign-in, I successfully opened all four older tasks without being logged out. The task resumes continued to return errorCode=null, with no further refresh_token_invalidated errors while opening them.

The successful test happened on the same ChatGPT/Codex build that had previously failed. I had staged a reinstall, but the logs confirmed the app was still running from the older copy, so I do not consider reinstalling or renaming the app to be the fix.

I did not delete ~/.codex, its session files, or its SQLite databases. Those contained healthy local task history, and deleting them could cause data loss.

Environment:

• macOS 27 beta (26A5421a)
• ChatGPT/Codex 26.818.61809, build 7019

Btw I also have advanced security on so that shouldn't be the issue

I still observed a separate account-settings 401 saying Must use workspace account for this operation, but it no longer logged me out or prevented older tasks from opening. Therefore, this should be considered a workaround rather than a confirmed root-cause fix.

Subject: Urgent Feedback: Repeated Sign-Outs and Login Redirects in the Codex Desktop App

Dear OpenAI Support Team,

I hope you are doing well.

I am writing to report a persistent authentication problem in the Codex desktop application that has been occurring for approximately two weeks. Unfortunately, this issue has made the desktop application extremely frustrating and, at times, nearly impossible to use.

The problem occurs as follows:

1. I open the Codex desktop application and successfully sign in with my ChatGPT account.
2. I create a new task and Codex begins working normally.
3. After a short period, the application unexpectedly redirects me to the ChatGPT sign-in page.
4. I complete the authentication process successfully and return to the application.
5. When I click an active task or even a previously completed task, its contents may appear for approximately one second before the application redirects me to the sign-in page again.
6. This cycle can repeat 10, 20, or even 30 times.

Importantly, my ChatGPT session in the browser remains active throughout this process. I am not being signed out of ChatGPT in the browser. Only the Codex desktop session repeatedly loses its authenticated state.

The application logs show a very specific sequence:

account_login_completed success=true
authenticatedAccountPresent=true
desktop_fetch_auth_401
auth_token_missing
authenticatedAccountPresent=false
account_info_token_unavailable

In one observed instance, authentication completed successfully, the account was recognized correctly, and approximately 17 seconds later the desktop application reported that the authentication token was missing.

The associated responses include:

401 Unauthorized
Missing valid access token or actor biscuit

There have also been occasional temporary network errors such as:

ERR_NETWORK_CHANGED
ERR_NAME_NOT_RESOLVED
ERR_CONNECTION_RESET
ERR_TIMED_OUT

However, temporary network interruptions or isolated 401 responses should not immediately destroy the authenticated desktop session or force the user back to the sign-in page.

My current environment is:

Operating system: Windows
Codex desktop package: 26.820.7780.0
Bundled Codex CLI: 0.150.0-alpha.8
Authentication method: Sign in with ChatGPT

The Codex CLI continues to report:

Logged in using ChatGPT

even when the desktop application has already returned to the sign-in screen. This suggests that the general ChatGPT authentication remains valid while the desktop-specific account state is being lost.

I respectfully ask the engineering team to reconsider how the desktop application handles temporary authentication and network failures. Ideally, the application should:

• Retry temporary 401 and network failures with an appropriate backoff.
• Attempt token refresh before invalidating the desktop session.
• Preserve the current task and authenticated state during temporary connectivity problems.
• Display an offline or reconnecting message instead of immediately redirecting to the login screen.
• Require full reauthentication only when the server has definitively confirmed that the session or refresh token is invalid or revoked.
• Avoid triggering a complete sign-out because of a single failed request to an account, settings, usage, heartbeat, or task-list endpoint.

Internet connectivity is not equally stable in every country or region. Users may experience brief DNS failures, routing changes, packet loss, or temporary connection resets. A desktop application should tolerate these conditions gracefully instead of repeatedly interrupting the user’s work and forcing a complete login flow.

This behavior creates a very poor and stressful user experience. It disrupts concentration, wastes significant time, and can make users feel that their ongoing work or completed tasks are no longer accessible. If it remains unresolved, it may unfortunately cause users—particularly those in regions with less stable connectivity—to stop using the desktop application or move away from the product entirely.

I greatly appreciate Codex and the work your team is doing. I am sharing this report respectfully because I would very much like to continue using the desktop application, but the current authentication behavior urgently needs improvement.

Please investigate this issue and consider changing the client behavior so that transient 401 responses and temporary network errors do not automatically result in a complete sign-out.

I would be happy to provide additional sanitized logs, timestamps, screenshots, or diagnostic information if needed.

Thank you very much for your time and attention.

Kind regards,
Hamed Abdollahi