Codex Desktop (26.810.41047) silently switched from ChatGPT-subscription billing to a dormant 2024 API key — ~$758 unintended API charges overnight

What happened

Codex Desktop (Version 26.810.41047, macOS), signed in with a ChatGPT account, switched from ChatGPT-subscription billing to a dormant API key created in August 2024 — silently, with no visible opt-in — and billed ~$758 to my API organization overnight.

Timeline (UTC):

• Aug 24–25: a Codex heartbeat automation (30-min interval, large cached context) ran continuously, billed entirely to the ChatGPT subscription. Zero API-side usage in the org's usage API for these days.
• Aug 25 ~23:00: gpt-5.6-sol usage abruptly appears on the API key: 84 requests in the first hour, then 470/320/283/237/205/273/119 per hour, tapering to zero by ~09:00 UTC Aug 26.
• Window totals (from the org costs/usage APIs): 1,960 requests, 818.5M input tokens (97% prompt-cached, ~400k avg context), 1.12M output tokens, $721.66 — plus ~$36 in the first evening hours; ~$758 total since the switch.
• An isolated blip of 2 API requests on Aug 22 on the same key looks like an earlier brief instance of the same switch.

The key that was billed

• Unnamed user-owned key created 2024-08-20, sitting in a project dormant since then — the shape of a key auto-minted from a ChatGPT login by an OpenAI tool at that time.
• The key exists nowhere the app could read it locally: ~/.codex/auth.json holds ChatGPT OAuth tokens and an empty OPENAI_API_KEY field; there is no ~/.codex/.env; the shell environment's OPENAI_API_KEY is a different (current) key; the billed key's only local trace anywhere on the machine is a commented-out line in an unrelated dormant repo's .env. As far as I can tell, the credential can only have come from state stored server-side against my account.

The service_tier oddity

~/.codex/config.toml contained service_tier = "priority", which I don't remember setting — #40561 reports the Desktop app rewriting that value on its own. Priority tier made the unintended API traffic substantially more expensive.

Why I think this is a bug and not a feature

• The docs describe ChatGPT sign-in and API-key billing as separate modes, and requests to add exactly this fallback ("switch to my API key when my ChatGPT limit runs out") were closed not planned (#20899, #21017), with a maintainer saying account-switching isn't something OpenAI wants to encourage.
• Prior reports of the same silent switch: #20099 ("Codex silently switches to API key auth … causing unintended billing") and #19861.
• Same-day (Aug 25) reports of Desktop routing/tier anomalies: #40573 (ChatGPT-authenticated Desktop surfacing an API no-credits error) and #40561 (service_tier rewriting).

Questions

1. Under what circumstances can a ChatGPT-authenticated Codex Desktop authenticate with an API key that exists only server-side, in a dormant project, without a local credential or a visible opt-in?
2. Is there a setting that governs this, and where would it be visible to the user?
3. Was there a change on/around Aug 25, 2026 that could explain the switch beginning at ~23:00 UTC?

Happy to provide timestamps, request IDs, and local config privately. (The billing side is with support separately; this issue is about the behavior.)

Start by comparing ~/.codex/auth.json, ~/.codex/config.toml, the shell environment, and the reported Desktop behavior. Use the Aug 25 timeline and related issues #40561, #40573, #20099, and #19861 to investigate how authentication and service_tier selection are connected. Done means identifying the trigger and user-visible setting, or documenting that no silent fallback should occur.