Desktop treats a refresh-token failure as full sign-out while the access token is still valid, then enters a 401 retry storm
<html><head></head><body><p><strong>Title:</strong> Desktop treats a refresh-token failure as full sign-out while the access token is still valid, then enters a 401 retry storm</p>
<hr>
<h3>Environment</h3>
|
-- | --
Codex Desktop | 26.818.31338, also reproduced on 26.818.41705
codex core client_version | 0.149.0
OS | macOS 26.6.1 (25G76)
Credential store | file (auth.json), single account entry
<p>Once the refresh token is known-invalid, the client should stop rather than accelerate. Every launch produces another burst of failing auth requests against the same endpoint.</p>
<h3>Second, independent credential path in the MCP transport</h3>
<p><code>rmcp::transport::worker</code> holds its own OAuth credential and fails separately, in its own retry loop:</p>
<pre><code>ERROR rmcp::transport::worker: worker quit with fatal: Transport channel closed,
when UnexpectedServerResponse("HTTP 401: {
\"error\": {
\"message\": \"Encountered invalidated oauth token for user, failing request\",
\"type\": null,
\"code\": \"token_revoked\",
\"param\": null
},
\"status\": 401
}")
</code></pre>
<p>Note this is a different error code (<code>token_revoked</code>) from a different subsystem than the auth manager's <code>refresh_token_invalidated</code>. It has the same problem: it does not stop on a terminal auth error.</p>
<p>Moving <code>~/.codex/config.toml</code> and <code>~/.codex/mcp-oauth-locks</code> aside stopped the <em>idle</em> sign-outs, but the <code>thread/resume</code> path still reproduces — so these look like two related but distinct retry loops.</p>
<h3>Suggested fixes</h3>
<ol>
<li>Skip the refresh when the access token has remaining lifetime; refresh on expiry or on a 401 from an actual API call, not on every <code>getAuthStatus</code>.</li>
<li>Treat a refresh failure as a refresh failure. Keep serving requests with the valid access token until it genuinely expires.</li>
<li>Treat <code>refresh_token_invalidated</code> / <code>token_revoked</code> as <strong>terminal</strong>: clear credentials, show one explicit "please sign in again" state, and make no further automatic attempts.</li>
<li>Apply the same terminal-error handling and backoff in the MCP transport worker.</li>
<li>Surface the actual error to the user. Currently the app silently returns to the sign-in screen with no indication of why, which makes this look like a local corruption problem and sends users through a long and fruitless local cleanup.</li>
</ol>
<h3>Possibly related</h3>
<ul>
<li>#31459 — Codex Desktop keeps using a revoked ChatGPT OAuth token after logout/login</li>
<li>#32337 — Agent-triggered logout/recovery loop revokes shared sessions and causes device-auth 429</li></ul></body></html>``
1 Comment
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action