ChatGPT.app Codex relay returns 403 'invalid or disabled credential' after v26.715.31925 update

Start by inspecting ~/.codex/config.toml and ~/.codex/auth.json, then compare their settings with the codex-rs/app-server/README.md guidance for ChatGPT OAuth. Trace the relay request entry point and determine whether the 403 comes from credential handling or the external relay; done means the incompatibility or required project change is clearly identified.

Summary

Codex inside ChatGPT Desktop App returns HTTP 403 "invalid or disabled credential" from the relay endpoint after updating to version 26.715.31925. The app shows "Reconnecting... 5/5" and never generates a response.

Environment

• App: ChatGPT Desktop App for macOS
• App version: 26.715.31925 (CFBundleVersion 5551)
• Codex Framework: 150.0.7871.124
• OS: macOS 26.5.2 (arm64)
• Auth mode: ChatGPT OAuth (auth_mode: chatgpt)
• Account: ChatGPT Pro
• ChatGPT web: works normally

Steps to reproduce

1. Open ChatGPT.app (version 26.715.31925) on macOS.
2. Switch to Codex mode or start a code-related conversation.
3. Send any message.
4. Observe the error bubble: "Reconnecting... 5/5" followed by the 403 error.

Expected behavior

Codex should process the request and generate a response using the ChatGPT OAuth session, the same way ChatGPT web conversations work.

Actual behavior

The relay endpoint https://chat-response.codex-openai.com/relay/responses returns:

unexpected status 403 Forbidden: {"error":"invalid or disabled credential"}

The app retries 5 times then shows the error. No response is generated.

Additional context

Config

The auto-generated ~/.codex/config.toml configures:

[model_providers.OpenAI]
name = "OpenAI"
base_url = "https://chat-response.codex-openai.com/relay"
wire_api = "responses"
requires_openai_auth = true

Auth

~/.codex/auth.json reports:

• auth_mode: chatgpt (ChatGPT OAuth)
• OPENAI_API_KEY: [not set]
• ChatGPT tokens present (id_token, access_token, refresh_token)
• Last refreshed: 2026-07-18T07:21:47Z (after app update)

Network diagnostics

• Domain chat-response.codex-openai.com resolves, SSL certificate is valid.
• Endpoint responds 401 without auth headers (expected).
• Domain is reachable both through proxy and direct connection.
• chatgpt.com/backend-api works for web conversations.

What was tried

1. codex logout + codex login — CLI re-auth succeeds, Desktop relay still fails.
2. Full ChatGPT.app restart.
3. Delete ~/.codex/auth.json + cookies + re-login via app.
4. Complete reinstall of ChatGPT.app.
5. codex login --device-auth.
6. Proxy on/off — no change.

Suspected cause

The new Codex framework v150.0.7871.124 introduces chat-response.codex-openai.com/relay as the API base URL, replacing the previous chatgpt.com/backend-api/codex/responses path. The relay has requires_openai_auth = true but the active auth mode is chatgpt (ChatGPT OAuth). The relay endpoint appears to reject ChatGPT OAuth tokens — it recognizes the token format (returns 403, not 401) but marks the credential as "invalid or disabled". The official app-server README states that chatgpt (ChatGPT managed OAuth) is the recommended auth mode, suggesting the relay should accept ChatGPT OAuth tokens.

Related issues

• #9271 similar 403 from chatgpt.com/backend-api/codex/responses
• #18681 403 during Codex service outage
• #31882 Responses-Lite and auth mismatch for non-default providers