Codex CLI cannot log in on headless environments unless Device Code auth is enabled by workspace admin

Additional context:

The current Codex CLI does not provide any browser-based or interactive login option.

Output of codex login --help shows that the only supported authentication methods are:

• --device-auth (OAuth Device Code flow)
• --with-api-key (API key via stdin)

There is no --browser, --interactive, or similar option that would allow a
standard OAuth browser login with a local callback.

This is important because if a browser-based login option existed, it would be
possible to authenticate even in remote/headless environments by using common
workarounds such as:

• VS Code Remote / integrated browser
• SSH port forwarding to a local browser
• Remote development environments with forwarded callbacks

In previous workflows (and in other developer tools), browser-based OAuth login
works correctly in these scenarios. However, because Codex CLI currently forces
Device Code authentication in headless environments and offers no alternative,
users are completely blocked when Device Code auth is disabled at the workspace level.

In short:

• Browser-based login is not available in Codex CLI
• Device Code auth is mandatory in headless environments
• When Device Code auth is disabled, there is no viable login path, even though

the user is authorized and could authenticate via a browser if such an option existed

Please refer to our authentication documentation, which offers multiple fallback techniques if device code authentication isn't an option.

FWIW you can fudge this by running DISPLAY=nothing codex and unsetting SSH-related environment variables, which will make the old non-headless login flow trigger, which still works, albeit every bit as poorly as it ever did.

https://github.com/openai/codex/blob/1fc72c647fd52e3e73d4309c3b568d4d5fe012b5/codex-rs/core/src/env.rs#L29

Imagine paying for a feature you can’t use.

$ unset CI SSH_CONNECTION SSH_CLIENT SSH_TTY
$ export DISPLAY=:0
$ codex

Your codex cli is trying to do headless login and device auth is supported only using the browser. You have to login using browser environment and copy the auth.json file to your headless server.

There is a fix to be released with the update soon i believe https://github.com/openai/codex/pull/9333

There is a fix to be released with the update soon i believe #9333

Not sure what you are referring to.

codex-rs rolled out a client-side change that was, conceptually, a good idea, except the server part is extremely half baked and doesn’t actually work (yet?) for business customers. Classic release management error.

Unless the server side will be fixed extremely quickly, presumably the right solution would be for codex-rs to release a fix that temporarily disables the new feature until the server side is ready. And then re-enable it whenever the server part is fully deployed and all the relevant admin settings are documented.

@amluto, we deployed a server-side fix a few hours ago. Please give it a try when you have a chance, and let us know if it's working for you now.

@amluto, we deployed a server-side fix a few hours ago. Please give it a try when you have a chance, and let us know if it's working for you now.

(codex-rs is not needed to test this: just navigating to https://auth.openai.com/codex/device is sufficient)

If I go to the device auth page, it still says "Please contact your workspace admin to enable device code authentication". On that page, if I change my desired sign in to my personal account (which I suspect is some old free tier thing I never use on account of using ChatGPT and Codex exclusively via a workspace account), it gives me this message:

Enable device code authorization for Codex in ChatGPT Security Settings, then run "codex login --device-auth" again.

If I click that link, I get a page that has no such setting. But I kind of expected that because the actual error said that the _workspace admin_ needed to do it.

The workspace admin in question is _me_. So I went to https://admin.openai.com and looked at literally every setting I could find (there are very few of them), and none of them look even remotely relevant.

So I would rate this as not fixed yet.

Reopening issue. We'll investigate.

Correct. There is no setting anywhere to be enabled. This works on Personal account though. Business only issue. And very annoying.

I am the workspace admin and even though I have approved device auth code login it still tells me that an administrator needs to enable it. This is an enterprise account.

I have the same issue. Using codex-cli 0.87.0. I tried to degrade it to 0.81.0 but no change.

v0.88.0 seems to solve the issue

v0.88 not helping on my side, I'm still not seeing the setting in business plan (do see it on personal plan)

v0.88.0 seems to solve the issue

The problem is with OpenAI's login system, not with codex-rs per se. You can reproduce the problem easily by going to https://auth.openai.com/codex/device without any interaction with codex-rs.

@etraut-openai, this issue is going on two weeks with no apparent resolution. I've been working in parallel with the account support people, and they seem completely unable to comprehend the issue despite my sending them lots of descriptions and even a screencast. At what point should codex-rs revert the change or add an extra explicitly prompted option to use the non-headless mode while waiting for the server side to get fixed?

Imagine if Microsoft released a fancy update to the Excel application on Windows (whatever they call it these days) that switched half the users, by default, with no obvious fallback, to Improved Excel Signin, that was unable to log into business tier Microsoft online account because the online account team had forgotten to add the little checkbox "allow your users to use Improved Excel Signin"? Sure, the bug would technically be on the online account side, but I think the client people would seriously consider reverting or working around the problem while waiting for the server people to fix the settings.

@amluto, apologies for the delay. As you point out, the fix for this issue isn't in the Codex clients. It involves a change to the main ChatGPT site. The fix is in the works and should be deployed soon. Thanks for your patience.

i know you're working on it, i just want to report +1 (if that helps)

We are ChatGPT Business subscription with 11 users, this is a really annoying issues for us. I am the owner, kept receiving pings from users regarding this issue, but no idea how to enable this, the bot did not provide any workaround at all.

<img width="501" height="329" alt="Image" src="https://github.com/user-attachments/assets/8c6f0677-709c-4ca2-93aa-c47e6e76a1ff" />

The workspace login issue should have been fixed, please try again and let us know how it goes.
If you are an admin and need to toggle it on, you can find the toggle here in you workspace settings page:

<img width="3288" height="1334" alt="Image" src="https://github.com/user-attachments/assets/0f3c019d-25b0-4bee-a614-b2d618a1a92f" />

Thanks for reply. @mzeng-openai
Sorry, I do not have such an option. Codex Local is not visible in my view. I am the owner of my organization.

<img width="940" height="936" alt="Image" src="https://github.com/user-attachments/assets/bccba5dc-f2a8-4a58-a61f-40a4b1fa03a1" />

<img width="665" height="284" alt="Image" src="https://github.com/user-attachments/assets/6704afdb-56a3-44b6-bae2-36acf4f4f80b" />

Root Cause
The backend enforces an Enterprise-only entitlement for codex_device_code_auth on POST /backend-api/accounts/{account_id}/beta_features. Your account is on the Team plan, so the server rejects the toggle with {"detail":"Enterprise plan required."}. This is a server-side plan gate, not a UI/FE issue.

Analysis Process

• Confirmed the workspace/account context: a?.planType === "team".
• Attempted to enable the flag by directly calling:

POST https://chatgpt.com/backend-api/accounts/<id>/beta_features with {feature:"codex_device_code_auth", value:true}.

• The server returned HTTP 401 with a hard failure payload: Enterprise plan required.
• This proves the toggle cannot be enabled via frontend overrides or “force show” because the write path is blocked by plan entitlement.
• Any missing UI entries / g sections not showing are consistent with upstream gating, but the definitive blocker is the backend entitlement check on update.

Same problem here! With Azure Foundry Sweden Central down today and not able to use Codex CLI on headless environments, just had to get a bunch of Anthropic Team Premiums seats to save the day...

Yep, also have a business plan and my members are constantly saying they can't login.

By the way, a solution to this is doing the OAuth flow on a normal computer with a browser, and then copying the file ~/.codex/auth.json into the headless environment. The token will then get refreshed and managed by the headless codex instance... or so it seems

Yes, if you're currently unable to use device code authentication, there is a fallback mechanism documented here.

I am running Codex CLI (via ChatGPT Business) in an environment where I can't pull in additional files or expose an external port, so the documented workaround will not work at this stage.

@simonrejzek @asw101 we rolled out a fix a few hours ago for the admin settings panel for device code auth. Can you try again in https://chatgpt.com/admin/permissions and let me know if you can toggle device code on?

@mzeng-openai I can also see it, and it is similarly greyed out under Enterprise and set to off by default.

I was also unable to modify the "Enable device code authentication for Codex CLI" setting due to it being locked to enterprise. That was yesterday. My team is on the Business plan.

As of today, the setting is no longer disabled, but enabling it returns an error, and refreshing the page shows it is still disabled. Viewing the beta_features API response associated with the attempt to change the setting indicates the feature still requires enterprise.

{"detail":"Enterprise plan required."}

<img width="953" height="534" alt="Image" src="https://github.com/user-attachments/assets/ebb4c0e5-88d9-4f78-8f6a-f0d5415c342b" />

Any update for this?

Any updates?

I used ssh port forward to fix this issue:

1. Terminal: ssh -L 1455:localhost:1455 {USER}@{HOSTNAME}, this would login to your remote headless shell
2. Terminal in the remote shell: codex login, it will show an URL, copy and paste to local browser and login

I am also receiving "Failed to update feature setting" (screenshot from mobile)

@simonrejzek @asw101 we rolled out a fix a few hours ago for the admin settings panel for device code auth. Can you try again in https://chatgpt.com/admin/permissions and let me know if you can toggle device code on?

I am now able to enable the setting in https://chatgpt.com/admin/permissions, thank you @mzeng-openai and team!

<img width="1180" height="725" alt="Image" src="https://github.com/user-attachments/assets/3da650b1-03f0-44ca-aa89-217de1021344" />

@asw101, thanks for the confirmation. And apologies that it took so long to get this resolved. There were multiple issues involved, and we discovered and fixed them serially.