›_ Codex Issues
Codex Issues / #40761

[Windows] Codex Desktop login succeeds, then /accounts/{id}/settings 401 causes auth_token_missing and a reauthentication loop (26.820.7780.0)

Open 💬 6 comments Opened Aug 26, 2026 by robjarawan
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex CLI is running?

0.150.0-alpha.8 (bundled with Codex Desktop 26.820.7780.0)

What subscription do you have?

Pro

Which model were you using?

GPT-5.6-sol

What platform is your computer?

Windows 11 (10.0.26200, x64)

What terminal emulator and version are you using (if applicable)?

Not applicable — this occurs in Codex Desktop.

Codex doctor report

Ran the bundled codex doctor --json after closing Codex Desktop. Relevant redacted results:

overallStatus: warning
codexVersion: 0.150.0-alpha.8
auth.credentials: ok — auth configured; stored ChatGPT tokens present
config.load: ok
desktop.app.version: ok — 26.820.7780.0 installed
network.provider_reachability: ok
network.websocket_reachability: ok — HTTP 101 Switching Protocols
state database integrity checks: ok
security.endpoint: warning — Microsoft Defender exclusions unverified

The Defender warning does not correspond to the observed authentication sequence. Because Desktop was closed, the live Desktop/app-server handshake was skipped.

What issue are you seeing?

Codex Desktop records browser-based ChatGPT/passkey authentication as successful and briefly recognizes the authenticated account. Seconds later, a request to /backend-api/accounts/{account_id}/settings made with the cached token receives HTTP 401. Desktop then changes its state to hasToken=false / auth_token_missing, stops attaching the token, and returns to the sign-in flow.

The security-key prompt is therefore the visible consequence of repeated reauthentication; the key interaction itself completes successfully.

Strongest observed sequence on August 25, 2026 (America/Toronto, UTC-04:00):

22:38:30.588  account_login_completed success=true
22:38:31.438  authenticatedAccountPresent=true result=succeeded
22:38:39.024  desktop_fetch_auth_401 hadToken=true tokenSource=cached willRetry=true
22:38:39.269  hasToken=false nullReason=auth_token_missing refreshToken=true tokenExpiryState=missing
22:38:39.485  /accounts/{account_id}/settings -> 401 "Missing valid access token or actor biscuit"

The token was issued at 22:38:30, was unexpired, and its stored account ID matched the ID-token claim, access-token claim, and request URL. No token values or account identifiers are included here.

I observed nine instances of the cached-token 401 → auth_token_missing collapse across three Codex Desktop process sessions. The problem persisted across application restarts.

Installed versions:

  • Codex Desktop: 26.820.7780.0
  • Bundled Codex CLI/app-server: 0.150.0-alpha.8
  • ChatGPT Desktop: 1.2026.190.0

What steps can reproduce the bug?

  1. Start Codex Desktop on Windows.
  2. Select Sign in with ChatGPT.
  3. Complete the browser sign-in using the configured passkey/security key.
  4. Return to Codex Desktop; the app initially shows the account as authenticated.
  5. Open or continue a thread, or wait for the account-settings refresh.
  6. Within seconds or minutes, Desktop receives a 401 from /accounts/{account_id}/settings, changes to auth_token_missing, and asks for authentication again.
  7. Repeat the sign-in; it succeeds again and the same sequence recurs.

Uploaded thread: 01a03bef-5da3-7542-865a-7b1e4fe9a4c5

What is the expected behavior?

After a successful ChatGPT/passkey sign-in, Codex Desktop should retain and attach the newly issued authentication token. A 401 from an account-settings request should not discard otherwise usable authentication state or trigger an endless security-key/sign-in loop.

Additional information

Representative local log:

AppData/Local/Packages/OpenAI.Codex_2p2nqsd0c76g0/LocalCache/Local/Codex/Logs/2026/08/26/
codex-desktop-9b76f5f2-df43-4f24-bd42-3c7f7e3df3b7-19316-t0-i1-022543-0.log

Related open reports with closely matching sequences:

  • #40374 — /accounts/{account_id}/settings 401 followed by lost access token
  • #40699 — hadToken=true → auth_token_missing → repeated sign-in
  • #39925 — unrelated settings 401 followed by rejection/discard of fresh authentication state
  • #39170 — successful login followed by 401/auth loop with Advanced Account Security

The broader issue reproduces in reports both with and without Advanced Account Security, so passkeys/security keys appear to expose the loop but may not be the root cause.

View original on GitHub ↗

6 Comments

github-actions[bot] contributor · 2 days ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #40374
  • #40699
  • #39925
  • #39850
  • #40373

Powered by Codex Action

robjarawan · 1 day ago

Workaround validation (2026-08-26): I installed the Microsoft Store ChatGPT (Beta) side-by-side (AppX package 26.727.4816.0; runtime reports 26.727.40816) without uninstalling stable or clearing credentials.

Beta loaded the authenticated account and opened the exact previously triggering recent thread, “Avery Label Design (2)”, normally. I monitored it for 35 seconds after opening; the Beta process remained alive and its fresh diagnostic scope contained 0 occurrences of:

  • desktop_fetch_auth_401
  • auth_token_missing
  • Missing valid access token
  • HTTP status_code: 401

Stable 26.820.7780.0 remains installed, so this is a confirmed temporary workaround and additional evidence that the loop is a regression in the stable build line—not proof of an upstream fix.

neo-cube · 1 day ago

Additional Windows reproduction on the same Codex Desktop build (26.820.7780.0).

The failure reproduces 100% after successful ChatGPT browser authentication when sending a message or opening an existing project:

desktop_fetch_auth_401 hadToken=true
target="GET https://chatgpt.com/backend-api/accounts/:param/settings"

authMethod=chatgpt
hasToken=false
nullReason=auth_token_missing
refreshToken=true
tokenExpiryState=missing

failureType=account_info_token_unavailable
errorMessage="Missing valid access token or actor biscuit"
status=401

The following desktop-side causes were tested without resolving the issue:

  • Reset the MSIX web profile and cache.
  • Re-registered the Windows Appx package manifest.
  • Tested with a completely new isolated CODEX_HOME.
  • Reauthenticated through the ChatGPT browser flow with fresh credentials.
  • Fully uninstalled the MSIX package and removed its app-local cache.
  • Reinstalled the official Microsoft-signed package.
  • Confirmed the package registration status is Ok.
  • Confirmed that no proxy is configured and HTTPS certificate validation succeeds for chatgpt.com and auth.openai.com.

The Codex IDE extension remains signed in and functional with the same ChatGPT account, including while the desktop app repeatedly returns to the login screen. This appears specific to the desktop authentication path rather than a general account sign-in failure.

One additional impact: using Logout in Codex Desktop removes the shared %USERPROFILE%\.codex\auth.json, which also signs the IDE extension out. After logout, the desktop UI displays Oops, an error has occurred while continuing unauthenticated backend calls.

These results make local cache corruption, installation damage, proxy/TLS failure, and shared-home contention unlikely. The remaining lead is the desktop authentication bridge or account-token/actor-biscuit compatibility: the token is present before the account-settings 401 and becomes unavailable immediately afterward.

neo-cube · 1 day ago

Additional trigger and regional context:

  • The issue began shortly after enabling SMS two-step authentication and adding a password in the account Security/Login settings.
  • This reproduction is from Japan (JST), with no configured proxy.

The timing does not prove causation, but it may be relevant given the similar authentication-loop reports associated with account security changes (for example, #39170 and #39685). No phone number, password, account identifier, IP address, or other authentication data is included here.

serkan1712 · 2 hours ago

Additional Windows reproduction on the exact same stable Codex Desktop package (26.820.7780.0), using a ChatGPT Plus account. This reproduction does not have Advanced Account Security enabled.

Environment / versions:

  • Windows 11 x64 (Microsoft Windows NT 10.0.26200)
  • Codex Desktop MSIX: OpenAI.Codex_26.820.7780.0_x64__2p2nqsd0c76g0
  • ChatGPT Desktop package also installed: OpenAI.ChatGPT-Desktop 1.2026.190.0
  • Workspace/runtime UI reports: 26.826.11250
  • Standalone Codex CLI: 0.150.1, authenticated with the same ChatGPT account and working normally

Reproduction:

  1. Start Codex Desktop and complete the normal browser-based ChatGPT login.
  2. Desktop initially reaches the authenticated UI.
  3. Open/use Codex or send a prompt.
  4. Desktop loses authentication and returns to sign-in.
  5. Re-authentication succeeds, but the same loop repeats. Each successful re-login creates another Codex entry in ChatGPT's Active Sessions list.

Representative sanitized log sequence:

app_server_connection.auth_status_result
  authMethod=chatgpt
  hasToken=false
  nullReason=auth_token_missing
  refreshToken=true
  tokenExpiryState=missing

chatgpt-account-lookup
  authenticatedAccountPresent=false
  failureType=account_info_token_unavailable
  result=failed

sa_server_request_failed
  status=401
  errorMessage={"detail":"Missing valid access token or actor biscuit"}
  routePattern=/accounts/{account_id}/settings

sa_server_request_failed
  status=401
  errorMessage={"detail":"Unauthorized"}
  routePattern=/wham/onboarding/context

Troubleshooting/control tests already performed:

  • Confirmed CODEX_ACCESS_TOKEN is absent at both User and Machine environment scopes.
  • Advanced Account Security is not enabled.
  • Removed/renamed %USERPROFILE%\.codex\auth.json and performed a fresh ChatGPT login.
  • Fresh login successfully regenerated auth.json, but Desktop still returned to the sign-in loop.
  • ChatGPT Web remains authenticated and usable.
  • Standalone Codex CLI remains authenticated and works with the same account/project while Desktop is logged out.
  • Cleared the repeated Codex sessions from ChatGPT Active Sessions and reproduced again; new Codex sessions are created, but Desktop still loses its local/runtime auth state.

This strongly matches the existing issue's cached-token 401 -> auth_token_missing -> account_info_token_unavailable failure chain. The CLI/web controls plus fresh auth.json regeneration suggest the persistent credential/account itself remains valid while the stable Windows Desktop runtime loses or stops attaching the access token.

No access tokens, refresh tokens, cookies, account IDs, email addresses, or raw authentication files are included.

neo-cube · 2 hours ago

Update: account-session reset resolved the authentication loop in my environment

After further troubleshooting, I found an account-session reset that resolved the Windows Codex Desktop authentication loop in my environment.

Original failure

ChatGPT browser authentication completed successfully and the Codex Desktop UI initially appeared. However, sending a message or opening an existing project caused the app to receive a 401 response, lose its local authentication token, and return to the sign-in screen.

The relevant log sequence was:

hadToken=true
GET /backend-api/accounts/:param/settings -> 401
hasToken=false
auth_token_missing

The issue reproduced consistently after resetting the desktop profile, using a separate CODEX_HOME, and fully reinstalling the Windows package. The Codex IDE extension continued to work with the same ChatGPT account.

Workaround
  1. Open the ChatGPT web application.
  2. Open Settings → Security.
  3. Locate the active login sessions/devices.
  4. Select log out of all active sessions/devices.
  5. Sign in to the Windows Codex Desktop app again using the normal ChatGPT browser-authentication flow.
  6. Send a message and open an existing project to confirm that the desktop session remains authenticated.
Important: Logging out all active sessions signs the account out on other browsers and devices. Save in-progress work before doing this.
Verification completed
  • [x] Fresh Codex Desktop login succeeded after all active sessions were logged out.
  • [x] New chat messages could be sent without returning to the sign-in screen.
  • [x] Existing projects and conversations opened normally.
  • [x] Codex Desktop could be fully closed and reopened without recurrence.
  • [x] Windows restarted without recurrence.
  • [x] Normal operation remained stable after a subsequent Codex Desktop update.
  • [x] ChatGPT web and mobile app sign-ins succeeded without disrupting the original Codex Desktop session.
  • [x] Signing in on a separate PC did not disrupt the original Codex Desktop session.
  • [x] Continued normal use did not reproduce the authentication loop.
Outcome log

| Date/time (JST) | Test | Result | Notes |
|---|---|---|---|
| 2026-08-27 | Logged out all active ChatGPT sessions, then signed in to Codex Desktop again | Pass | Immediate authentication loop no longer reproduced |
| 2026-08-27 | Sent messages and opened projects/conversations | Pass | No unexpected logout |
| 2026-08-27 | Full Codex Desktop restart | Pass | Authentication loop did not recur |
| 2026-08-27 | Windows restart | Pass | Codex Desktop remained operational after reboot |
| 2026-08-27 | Codex Desktop update followed by normal use | Pass | Continued working normally after the update |
| 2026-08-27 | Signed in through ChatGPT web and the mobile app | Pass | The original Codex Desktop session remained operational |
| 2026-08-27 | Signed in on a separate PC while continuing to use the original PC | Pass | Multi-device sign-in did not reproduce the authentication loop |

Why this result is significant

Desktop-side recovery steps did not resolve the issue, while invalidating all account sessions did. This suggests that stale or inconsistent account-side session state may have been involved rather than only local cache corruption or a damaged installation.

This does not establish the exact root cause. One possible interpretation is that the desktop authentication flow received credentials that were accepted during browser login but rejected by the subsequent account-settings request. Invalidating every active session may have forced the account and desktop app to establish a fully fresh session.

Relevant account context

The authentication loop began shortly after changes under the account's Security / Login settings, including adding a password and enabling SMS MFA. The timing does not prove causation, but it may be relevant to the account-side session state.

This should be treated as an account-specific workaround, not a universal fix. Similar-looking authentication failures may have different causes, and signing out all active sessions has not resolved every related report.

If the issue recurs, I will record the exact time, the operation immediately preceding the logout, whether the log again shows hadToken=true -> 401 -> hasToken=false, and whether the same account-session reset resolves it a second time.