Login session repeatedly expires

English translation:

What version of the Codex App are you using (From “About Codex” dialog)?

26.818.5229.0

What subscription do you have?

plus

What platform is your computer?

Windows10

What issue are you seeing?

Windows 10 19045, ChatGPT/Codex desktop app version 26.818.5229.0.
Login works normally on the web, but the desktop app automatically logs out a few minutes after a successful login.
The following continuously appears in the logs:
refresh_token_invalidated

codex-doctor.txt
doctor-after-logout.json

Failed to refresh token: 401 Unauthorized

<!-- Failed to upload "codex-doctor.txt" -->
<!-- Failed to upload "doctor-after-logout.json" -->

I cleared LocalAppData, deleted auth.json, switched to Windows keyring,
and uninstalled/disabled Codex++, CC Switch, and the global Codex CLI, but the issue can still be reproduced.

What steps can reproduce the bug?

After logging in, click a previous conversation.

What is the expected behavior?

_No response_

Additional information

no-active-thread-01a02ee8-b1d4-79c3-86b1-6e7cf186cfe6

<!-- codex-issue-translator -->

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #39925
• #39696
• #39199
• #39218

Powered by Codex Action

Additional diagnostic details:

• This issue is limited to the Windows desktop app. ChatGPT Web remains signed in and usable with the same account.
• Browser OAuth completes successfully. The desktop app initially works, but opening an existing conversation or waiting approximately 10–15 minutes causes it to return to the login screen.
• The observed authentication failure sequence is:

Failed to refresh token: 401 Unauthorized
Your refresh token has been invalidated
code: refresh_token_invalidated

This is subsequently followed by auth_token_missing/401 failures.

• Immediately after one forced logout, codex doctor --json still reported:

auth storage mode: File
stored auth mode: chatgpt
stored ChatGPT tokens: true

This indicates that local credentials were still present, but the refresh token was rejected or invalidated; the failure was not simply caused by a missing local authentication file.

• No HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, OPENAI, or CODEX environment overrides were detected.
• No managed proxy was configured, and the desktop assets CDN was reachable with HTTP 200.
• Codex++, CC Switch, and the global Codex CLI were disabled/uninstalled before the clean reproduction, and no matching processes were running.
• Reinstalling the desktop app, recreating %LOCALAPPDATA%\Codex, deleting ~/.codex/auth.json, and completing a fresh OAuth login did not resolve the original forced logout.
• Installed desktop package: OpenAI.Codex 26.818.5229.0.
• Codex Doctor reported desktop build 26.818.5345.0 as available, but Microsoft Store/winget did not offer that newer build.
• I confirmed that the OAuth browser did not have multiple ChatGPT accounts signed in simultaneously.
• I confirmed that Advanced Account Security was not enabled on the ChatGPT account.

The behavior appears related to #39925, #39696, and #39199, but this reproduction does not involve either of the suspected triggers described there: a multi-account ChatGPT Web session or Advanced Account Security. It may share the same downstream refresh_token_invalidated failure mechanism while having a different upstream trigger.

A potentially separate recovery issue was also observed during Windows keyring testing. After the related Windows Credential Manager entries were cleared, browser OAuth succeeded, but the callback failed with:

persist_failed
failed to write OAuth tokens to encrypted auth storage:
failed to decrypt secrets file

This keyring failure may be separate from the original refresh_token_invalidated logout, but it suggests that the client cannot safely recreate encrypted credential storage after it becomes undecryptable.

I can provide a sanitized desktop application log covering the successful login and the first failed refresh if needed. No access tokens, refresh tokens, account IDs, email addresses, or OAuth authorization codes will be included.

Sanitized desktop authentication log

This privacy-reviewed excerpt was produced from the local Codex desktop log archive captured on 2026-08-23.

It contains:

• the initial successful ChatGPT account lookup;
• subsequent auth_token_missing states while a refresh token was still detected;
• repeated 401 Unauthorized / refresh_token_invalidated refresh failures;
• the resulting app-server connection closures; and
• additional reproductions from separate desktop log sessions on the same day.

Windows usernames and paths, log/session UUIDs, request/connection/conversation IDs, unrelated activity, and all credential values were removed. The excerpt contains no email address, OAuth authorization code, cookie, Bearer token, JWT, API key, access-token value, refresh-token value, or ID-token value.

<details>
<summary><code>Codex-Auth-Logout-Sanitized-Log.txt</code> — click to expand</summary>

Sanitized authentication failure timeline for openai/codex#40242
================================================================

Source
------
- User-supplied Codex desktop log archive captured on 2026-08-23.
- Windows 10 Pro 19045, x64.
- Codex desktop package: OpenAI.Codex 26.818.5229.0.

Privacy treatment
-----------------
- Removed Windows username and home-directory paths.
- Removed log/session filenames and UUIDs.
- Removed request IDs, connection IDs, conversation IDs, and unrelated activity.
- No email address, OAuth authorization code, cookie, Bearer token, JWT,
  OpenAI API key, GitHub token, access token, refresh-token value, or ID-token
  value is included in this excerpt.

Relevant timeline (UTC)
-----------------------

2026-08-23T10:01:54.952Z
INFO [chatgpt-account-lookup]
result=succeeded authenticatedAccountPresent=true authMethod=chatgpt

2026-08-23T10:25:16.622Z
WARN [AppServerConnection] app_server_connection.auth_status_result
authMethod=chatgpt hasToken=false nullReason=auth_token_missing
refreshToken=true tokenExpiryState=missing

2026-08-23T10:25:59.538548Z
ERROR codex_login::auth::manager
Failed to refresh token: 401 Unauthorized
error.message="Your refresh token has been invalidated. Please try signing in again."
error.type="invalid_request_error"
error.code="refresh_token_invalidated"

2026-08-23T10:25:59.893Z
WARN [AppServerConnection] app_server_connection.auth_status_result
authMethod=chatgpt hasToken=false nullReason=auth_token_missing
refreshToken=true tokenExpiryState=missing

2026-08-23T10:29:20.433Z
INFO [AppServerConnection] app_server_connection.closed
code=1 cause=the refresh_token_invalidated error above

2026-08-23T10:30:08.868894Z
ERROR codex_login::auth::manager
Failed to refresh token: 401 Unauthorized
error.message="Your refresh token has been invalidated. Please try signing in again."
error.type="invalid_request_error"
error.code="refresh_token_invalidated"

2026-08-23T10:30:09.037Z
WARN [AppServerConnection] app_server_connection.auth_status_result
authMethod=chatgpt hasToken=false nullReason=auth_token_missing
refreshToken=true tokenExpiryState=missing

2026-08-23T10:31:46.481Z
INFO [AppServerConnection] app_server_connection.closed
code=1 cause=the second refresh_token_invalidated error above

Additional reproductions from separate desktop log sessions
-----------------------------------------------------------

2026-08-23T10:33:28.975329Z
ERROR codex_login::auth::manager
Failed to refresh token: 401 Unauthorized; error.code="refresh_token_invalidated"

2026-08-23T10:41:22.865886Z
ERROR codex_login::auth::manager
Failed to refresh token: 401 Unauthorized; error.code="refresh_token_invalidated"

2026-08-23T12:28:50.247096Z
ERROR codex_login::auth::manager
Failed to refresh token: 401 Unauthorized; error.code="refresh_token_invalidated"

Interpretation
--------------
The desktop client initially recognized an authenticated ChatGPT account, then
reported a missing access token while still detecting a refresh token. Refresh
attempts were rejected by the server with refresh_token_invalidated, after
which the local app-server connection closed. The same sequence occurred in
multiple desktop sessions on the same day.

This excerpt intentionally excludes the rest of the raw archive because those
logs contain unrelated activity, local filesystem paths, and conversation IDs.

</details>

A workaround that is currently working for me on Windows Desktop:

1. Create a brand-new browser profile, or use a completely different browser with no existing OpenAI/ChatGPT session.
2. Sign in to the intended ChatGPT account in that fresh browser profile/browser.
3. Fully quit the ChatGPT/Codex Desktop app, including all background processes.
4. Reopen the Desktop app and complete its sign-in flow only through that fresh browser profile/browser.
5. Avoid letting the OAuth flow use the old browser profile/session.

For me, using a completely isolated fresh browser session fixed the repeated sign-in / auto-logout loop and the app is working normally now. Sharing in case this helps others who are blocked.