Windows Stable: opening a thread immediately invalidates fresh OAuth refresh token with Advanced Account Security enabled; Beta works

What version of the Codex App are you using (From “About Codex” dialog)?

26.818.21641

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What issue are you seeing?

After enabling Advanced Account Security on my OpenAI account, the stable Windows Codex app can successfully sign in, but opening/resuming a Codex thread causes the app to lose the session and return me to the login screen.

The initial OAuth login itself succeeds. A fresh ~/.codex/auth.json is written and the newly issued access token is usable.

However, shortly after opening a thread, Stable calls getAuthStatus, attempts to refresh the OAuth token, and the refresh request is rejected by https://auth.openai.com/oauth/token with:

401 Unauthorized
code: refresh_token_invalidated
message: "Your refresh token has been invalidated. Please try signing in again."

The app then treats the account as signed out.

This is reproducible after a fresh login.

Important control case: the Codex Beta app works correctly on the same PC, Windows installation, network, OpenAI account, Advanced Account Security configuration, and shared ~/.codex directory.

Installed Beta package:

OpenAI.CodexBeta 26.727.4816.0

Beta app-server logs identify its client version as:

26.727.40816

With Beta, I can open the same existing thread and send prompts normally. Requests to /backend-api/codex/responses have:

auth_header_attached=true
auth_mode="Chatgpt"
auth_error=""
auth_error_code=""

During the same operation, Beta does NOT perform the immediate getAuthStatus -> Refreshing token -> /oauth/token sequence seen in Stable, and there are no 401 Unauthorized, token_revoked, or refresh_token_invalidated errors.

This problem started immediately after I enabled Advanced Account Security.

What steps can reproduce the bug?

1. Use a Windows account with Advanced Account Security enabled.

2. Launch stable Codex for Windows:

   About version: 26.818.21641
   AppX package: OpenAI.Codex 26.818.2441.0
   

3. Sign in with ChatGPT through the browser OAuth flow.

4. Browser authentication succeeds and Codex reports the login as completed.

   Example log sequence:

   received login callback ... has_code=true ... state_valid=true
   starting oauth token exchange
   oauth token exchange succeeded status=200 OK
   account/login/completed
   

5. Open or resume an existing Codex thread.

6. Stable subsequently performs:

   getAuthStatus
   Reloading auth
   Refreshing token
   

7. Codex sends:

   POST https://auth.openai.com/oauth/token
   

   and receives:

   401 Unauthorized
   
   {
     "error": {
       "message": "Your refresh token has been invalidated. Please try signing in again.",
       "type": "invalid_request_error",
       "code": "refresh_token_invalidated"
     }
   }
   

8. Codex returns to the login screen.

In one reproduction, the fresh OAuth login completed at approximately 13:14:57 local time and the refresh token was rejected at approximately 13:15:04 — only a few seconds after the successful login.

The access token itself was still usable: the Codex /responses WebSocket successfully connected with an attached ChatGPT authorization header around the same time the refresh operation failed.

Failed refresh request ID from that reproduction:

bad1fcb3-a0c8-4634-a078-c8079f502dce

Stable vs Beta A/B test

I also tested Codex Beta with Stable completely closed.

Process inspection confirmed the only running Codex backend was:

C:\Program Files\WindowsApps\OpenAI.CodexBeta_26.727.4816.0_x64__2p2nqsd0c76g0\...

With Beta:

• The same existing thread resumes successfully.
• Prompts can be sent and responses are received.
• ChatGPT authorization is attached successfully.
• No immediate OAuth refresh occurs when opening/using the thread.
• No refresh_token_invalidated error occurs.
• The app remains logged in.

Therefore this appears to be a behavioral regression between the current Stable and Beta Windows clients rather than a general inability of the account to authenticate.

What is the expected behavior?

After a successful OAuth login, opening or resuming a Codex thread should keep the authenticated session active.

If the current access token is valid, the Stable app should be able to use it normally, as the Beta app does.

A newly issued refresh token should not be reported as refresh_token_invalidated only a few seconds after a successful OAuth exchange.

If a token refresh fails while the existing access token is still valid, the desktop app also should not immediately discard an otherwise working authenticated session and return the user to the login screen.

Additional information

Troubleshooting already performed

• Manually logged out individual old Codex sessions from ChatGPT Security settings.
• Reset the Windows app data.
• Performed fresh OAuth logins.
• Confirmed a new Codex active session is created server-side after login.
• Confirmed ~/.codex/auth.json is freshly rewritten by the login.
• Confirmed no CodexBeta or legacy ChatGPT Desktop process was running during Stable reproduction.
• Confirmed only the expected Stable ChatGPT.exe processes and its child codex.exe were running.
• Reproduced the problem after resetting the application.
• Tested Beta as a control, where the same account works normally.

EDIT: IF YOU SUFFER A SIMILAR ISSUE, YOU MAY WANT TO TRY USING CHATGPT BETA 26.727.4816.0 AS A TEMPORARY FIX

Start by reproducing the Stable Windows flow around getAuthStatus and the POST to https://auth.openai.com/oauth/token, then compare its logs and behavior with the working Beta client. Trace the OAuth token handling and session decision after a successful login; done means opening a thread keeps the valid session active without an immediate refresh_token_invalidated logout.