Windows ChatGPT Desktop 26.820 signs out on first interaction after enabling Advanced Account Security — refresh token immediately invalidated (401)

What version of the Codex App are you using (From “About Codex” dialog)?

Microsoft Store / MSIX package: OpenAI.Codex_26.820.9563.0_x64__2p2nqsd0c76g0

What subscription do you have?

ChatGPT Plus account with Advanced Account Security enabled

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Immediately after enabling Advanced Account Security, ChatGPT Desktop on one Windows PC entered a persistent authentication loop.

Sign-in itself succeeds normally using the physical FIDO security key.

After signing in, the application successfully loads my account, existing projects, and conversation history.

However, as soon as I try to use a conversation / send a prompt, the application signs me out and returns to the login screen.

I can sign in again successfully, but the same behavior repeats indefinitely.

The local Codex logs show that the OAuth refresh request is rejected:

ERROR | codex_login::auth::manager
Failed to refresh token: 401 Unauthorized

{
"error": {
"message": "Your refresh token has been invalidated. Please try signing in again."
}
}

The failing request is:

POST https://auth.openai.com/oauth/token
status=401 Unauthorized

The initial authentication therefore appears to succeed, but the newly obtained refresh token is subsequently treated as invalid.

Important control tests

The same OpenAI account and Advanced Account Security configuration work correctly in:

ChatGPT Web on the affected PC
ChatGPT mobile
ChatGPT Desktop on another Windows PC

The physical YubiKey/FIDO authentication works correctly.

This appears to be specific to the ChatGPT Desktop authentication state on this particular Windows installation.

Steps to reproduce
Enable Advanced Account Security on the ChatGPT account.
Open ChatGPT Desktop for Windows.
Sign in using the browser authentication flow and physical FIDO security key.
Authentication completes successfully.
ChatGPT Desktop loads projects and existing conversations.
Open a conversation or attempt to send a prompt.
The application attempts an OAuth token refresh.
https://auth.openai.com/oauth/token responds with 401 Unauthorized.
The log reports that the refresh token has been invalidated.
ChatGPT Desktop returns to the login screen.
Signing in again reproduces the same loop.
Troubleshooting already performed

The following steps did not resolve the issue:

Completely exited ChatGPT Desktop.
Rebooted Windows.
Used Windows Repair / Reset for the ChatGPT application.
Removed the MSIX application with:
Get-AppxPackage -Name OpenAI.Codex | Remove-AppxPackage
Rebooted and reinstalled ChatGPT from the Microsoft Store.
Removed/recreated the package-local application state.
Renamed/regenerated:
%USERPROFILE%\.codex\auth.json
%USERPROFILE%\.codex\cap_sid
Confirmed there are no ChatGPT/OpenAI credentials stored in Windows Credential Manager via cmdkey /list.
Confirmed that the same account works correctly on another Windows PC running ChatGPT Desktop.

None of these changed the behavior.

Expected behavior

A newly authenticated ChatGPT Desktop session should remain signed in after successful FIDO/AAS authentication.

A newly issued OAuth refresh token should not immediately be rejected as invalid during normal application use.

The desktop application also should not discard an otherwise successfully authenticated session solely because the refresh operation fails immediately after login.

Related issues

This appears closely related to:

#39696 — Windows Stable: opening a thread immediately invalidates fresh OAuth refresh token with Advanced Account Security enabled
#39685 — Windows Desktop repeatedly logs out after sending one message when Advanced Account Security is enabled
#39170 — Windows Desktop loses ChatGPT authentication shortly after enabling Advanced Account Security
Security / privacy

I have intentionally not attached auth.json, cap_sid, the complete logs_2.sqlite database, access tokens, refresh tokens, cookies, account IDs, request IDs, or other authentication material.

I can provide additional sanitized log lines if needed.

What steps can reproduce the bug?

1. Enable Advanced Account Security on the OpenAI/ChatGPT account.
2. Open ChatGPT Desktop for Windows.
3. Sign in using the normal browser authentication flow and a physical FIDO security key/YubiKey.
4. Authentication completes successfully and the app loads existing projects and conversations.
5. Open any existing conversation or start a new one.
6. Try to send a prompt.
7. The app signs out immediately and returns to the login screen.
8. Sign in again.
9. Repeat step 5 or 6.
10. The same logout loop occurs again.

The issue reproduces consistently on the affected Windows PC, while the same account works correctly in ChatGPT Web, mobile, and ChatGPT Desktop on another Windows PC.

What is the expected behavior?

After successfully signing in with Advanced Account Security and the physical FIDO security key, ChatGPT Desktop should remain authenticated and allow normal use of conversations and projects without immediately signing the user out.

The OAuth session/refresh token issued after login should remain valid and be accepted when the application refreshes the session.

Additional information

The same OpenAI account and Advanced Account Security configuration work correctly in ChatGPT Web, ChatGPT mobile, and ChatGPT Desktop on another Windows PC.

On the affected PC, sign-in succeeds and the app loads projects and conversation history, but the session is lost as soon as I try to use a conversation.

The local logs show repeated OAuth refresh failures:

POST https://auth.openai.com/oauth/token → 401 Unauthorized

with the message:

Your refresh token has been invalidated. Please try signing in again.

Troubleshooting already performed without success:

Windows Repair/Reset for the app
Full MSIX removal with Remove-AppxPackage and reinstall from Microsoft Store
Reboot
Recreated the app-local profile/state
Renamed/regenerated %USERPROFILE%\.codex\auth.json and cap_sid
Checked Windows Credential Manager for OpenAI/ChatGPT credentials

App package version: OpenAI.Codex_26.820.9563.0_x64__2p2nqsd0c76g0

I have not attached complete authentication files or logs because they may contain sensitive identifiers or tokens.