[Windows] Codex Desktop login succeeds, then /accounts/{id}/settings 401 causes auth_token_missing and a reauthentication loop (26.820.7780.0)

What version of Codex CLI is running?

0.150.0-alpha.8 (bundled with Codex Desktop 26.820.7780.0)

What subscription do you have?

Pro

Which model were you using?

GPT-5.6-sol

What platform is your computer?

Windows 11 (10.0.26200, x64)

What terminal emulator and version are you using (if applicable)?

Not applicable — this occurs in Codex Desktop.

Codex doctor report

Ran the bundled codex doctor --json after closing Codex Desktop. Relevant redacted results:

overallStatus: warning
codexVersion: 0.150.0-alpha.8
auth.credentials: ok — auth configured; stored ChatGPT tokens present
config.load: ok
desktop.app.version: ok — 26.820.7780.0 installed
network.provider_reachability: ok
network.websocket_reachability: ok — HTTP 101 Switching Protocols
state database integrity checks: ok
security.endpoint: warning — Microsoft Defender exclusions unverified

The Defender warning does not correspond to the observed authentication sequence. Because Desktop was closed, the live Desktop/app-server handshake was skipped.

What issue are you seeing?

Codex Desktop records browser-based ChatGPT/passkey authentication as successful and briefly recognizes the authenticated account. Seconds later, a request to /backend-api/accounts/{account_id}/settings made with the cached token receives HTTP 401. Desktop then changes its state to hasToken=false / auth_token_missing, stops attaching the token, and returns to the sign-in flow.

The security-key prompt is therefore the visible consequence of repeated reauthentication; the key interaction itself completes successfully.

Strongest observed sequence on August 25, 2026 (America/Toronto, UTC-04:00):

22:38:30.588  account_login_completed success=true
22:38:31.438  authenticatedAccountPresent=true result=succeeded
22:38:39.024  desktop_fetch_auth_401 hadToken=true tokenSource=cached willRetry=true
22:38:39.269  hasToken=false nullReason=auth_token_missing refreshToken=true tokenExpiryState=missing
22:38:39.485  /accounts/{account_id}/settings -> 401 "Missing valid access token or actor biscuit"

The token was issued at 22:38:30, was unexpired, and its stored account ID matched the ID-token claim, access-token claim, and request URL. No token values or account identifiers are included here.

I observed nine instances of the cached-token 401 → auth_token_missing collapse across three Codex Desktop process sessions. The problem persisted across application restarts.

Installed versions:

• Codex Desktop: 26.820.7780.0
• Bundled Codex CLI/app-server: 0.150.0-alpha.8
• ChatGPT Desktop: 1.2026.190.0

What steps can reproduce the bug?

1. Start Codex Desktop on Windows.
2. Select Sign in with ChatGPT.
3. Complete the browser sign-in using the configured passkey/security key.
4. Return to Codex Desktop; the app initially shows the account as authenticated.
5. Open or continue a thread, or wait for the account-settings refresh.
6. Within seconds or minutes, Desktop receives a 401 from /accounts/{account_id}/settings, changes to auth_token_missing, and asks for authentication again.
7. Repeat the sign-in; it succeeds again and the same sequence recurs.

Uploaded thread: 01a03bef-5da3-7542-865a-7b1e4fe9a4c5

What is the expected behavior?

After a successful ChatGPT/passkey sign-in, Codex Desktop should retain and attach the newly issued authentication token. A 401 from an account-settings request should not discard otherwise usable authentication state or trigger an endless security-key/sign-in loop.

Additional information

Representative local log:

AppData/Local/Packages/OpenAI.Codex_2p2nqsd0c76g0/LocalCache/Local/Codex/Logs/2026/08/26/
codex-desktop-9b76f5f2-df43-4f24-bd42-3c7f7e3df3b7-19316-t0-i1-022543-0.log

Related open reports with closely matching sequences:

• #40374 — /accounts/{account_id}/settings 401 followed by lost access token
• #40699 — hadToken=true → auth_token_missing → repeated sign-in
• #39925 — unrelated settings 401 followed by rejection/discard of fresh authentication state
• #39170 — successful login followed by 401/auth loop with Advanced Account Security

The broader issue reproduces in reports both with and without Advanced Account Security, so passkeys/security keys appear to expose the loop but may not be the root cause.

Start with the cited local Codex Desktop log and the /backend-api/accounts/{account_id}/settings request, tracing the sequence from account_login_completed through desktop_fetch_auth_401 to auth_token_missing. Compare the cached token state with the 401 handling and related reports; done means a successful login does not discard usable authentication state or re-enter the sign-in loop.