Windows Codex browser OAuth refresh token is revoked, while Device Code authentication works and can restore Desktop Codex

Summary

I found a reproducible authentication difference on Windows Codex that may help narrow down the current refresh token was revoked / refresh_token_invalidated issue.

The normal Windows Codex "Continue with ChatGPT" browser/OAuth login completes successfully, but the resulting Codex authentication repeatedly fails when the client attempts to refresh the access token.

In contrast, after clearing the existing active ChatGPT/Codex sessions and rebuilding authentication through Device Code in the official OpenAI Codex extension in Cursor, Codex works normally.

After that Device Code authentication is established, completely closing Cursor and reopening the Windows ChatGPT/Codex app without performing another browser/OAuth login allows Desktop Codex to work without immediately reporting the revoked refresh token.

This suggests that the issue may be specific to the Windows Desktop browser-OAuth authentication or refresh path, rather than the ChatGPT account itself.

---

Environment

• Windows
• ChatGPT Pro account
• ChatGPT / Codex Windows app
• About Codex / bundled component version observed: 26.826.12353
• Official OpenAI Codex extension in Cursor
• Desktop Codex and the Cursor Codex extension appear to use authentication/state under the same Windows user profile, including %USERPROFILE%\.codex

---

Failure behavior

Using the normal Windows Codex "Continue with ChatGPT" login:

1. Login completes successfully.

2. Codex initially appears signed in.

3. A fresh local Codex authentication state is created.

4. When a Codex task is opened or executed, the client reports:

   Your access token could not be refreshed because your refresh token was revoked. Please log out and sign in again.

5. Signing out and signing back in using the same normal browser/ChatGPT login does not resolve the issue.

6. The problem can recur even after establishing a completely new login session.

---

Troubleshooting already performed

I performed the following checks to rule out common local causes:

1. Codex dependency diagnostics report healthy / PASS.
2. Normal ChatGPT web/chat remains usable with the same account.
3. All previous active ChatGPT/Codex sessions were logged out from the account's Active Sessions page.
4. Windows Codex was then signed in again from a clean login state.
5. The local %USERPROFILE%\.codex\auth.json was backed up and regenerated by a new Windows Codex login.
6. SHA256 confirmed that the old and newly generated auth.json files were different, so the client was not simply reusing the previous authentication file.
7. The newly authenticated Windows Codex session still produced the same refresh-token-revoked error.
8. Windows Credential Manager showed no obvious OpenAI / ChatGPT / Codex credential entry.
9. Codex projects themselves did not need to be recreated.
10. SSH/server connectivity did not appear to be the cause.
11. Normal ChatGPT conversations continued working while Windows Codex authentication failed.

These results make a stale project, stale auth.json, normal ChatGPT account failure, or SSH connectivity less likely as the primary cause.

Importantly, clearing all existing active sessions and then performing a fresh Windows browser/OAuth login alone did NOT resolve the issue.

---

Important Device Code observation / current workaround

The following recovery sequence currently works for me:

1. Close the Windows ChatGPT/Codex app.
2. Log out all existing active ChatGPT/Codex sessions from the account's Active Sessions page.
3. Confirm that the old Codex sessions are no longer being relied upon.
4. Keep the Windows ChatGPT/Codex app closed.
5. Open Cursor.
6. Open the official OpenAI Codex extension.
7. Authenticate Codex using Device Code authentication.
8. Confirm that the Cursor Codex extension can execute a task normally.
9. Completely close Cursor.
10. Open the Windows ChatGPT/Codex app again.
11. Do NOT perform another "Continue with ChatGPT" browser/OAuth login in the Windows app.
12. Open Codex and execute a task.

With this sequence, Windows Desktop Codex is able to work instead of immediately returning the revoked refresh-token error.

At the time of writing, multiple Windows Desktop Codex windows can remain open and operate normally after using this Device-Code-established authentication state.

This is currently an observed workaround, not proof that every step is required or proof of the exact root cause.

---

Additional observation

The Cursor Codex extension and Windows Desktop Codex appear to share at least some Codex authentication/state under:

%USERPROFILE%\.codex

This may explain why authentication established through the editor extension can subsequently be usable by the Windows Desktop app.

The authentication transition that succeeded was:

1. remove the previous active ChatGPT/Codex sessions;
2. keep Windows Desktop Codex closed;
3. authenticate Cursor Codex using Device Code;
4. verify Cursor Codex works;
5. completely close Cursor;
6. start Windows Desktop Codex;
7. do not initiate another Windows browser/OAuth login.

It may also be relevant that keeping both Cursor Codex and Windows Desktop Codex active at the same time appears to involve shared Codex state and/or processes.

For the successful workaround test, I avoided keeping both Codex clients active during the authentication transition.

---

Expected behavior

The Windows Codex "Continue with ChatGPT" browser/OAuth flow should create an authentication state whose refresh token remains valid and can refresh access tokens normally.

If browser OAuth and Device Code authentication ultimately represent equivalent ChatGPT authorization for Codex, both authentication paths should remain usable by Windows Desktop without immediately invalidating the refresh token.

---

Actual behavior

Windows Desktop browser/ChatGPT OAuth login

• Login succeeds.
• Codex initially appears authenticated.
• Access-token refresh then fails.
• The refresh token is reported as revoked/invalidated.
• Repeating browser/OAuth login does not reliably recover the session.
• Even after clearing all old active sessions and creating a fresh browser/OAuth login, the same failure occurs.

Device Code authentication through the Cursor Codex extension

• Existing active sessions were first cleared.
• Device Code authentication succeeds.
• Cursor Codex works normally.
• After closing Cursor and reopening Windows Desktop Codex, Desktop Codex can currently execute tasks successfully without immediately producing the revoked-token error.

---

Why this may be useful

This comparison may help narrow investigation to one or more of the following areas:

• Windows Desktop browser-OAuth token issuance;
• Windows Desktop refresh-token handling;
• refresh-token rotation or revocation behavior;
• Desktop authentication recovery logic;
• differences between browser OAuth and Device Code authentication;
• interaction between Desktop Codex and editor-extension Codex authentication;
• shared %USERPROFILE%\.codex authentication/state handling;
• session invalidation and re-establishment behavior;
• coordination between multiple Codex clients using the same Windows user profile.

The most useful observation in this reproduction is:

1. clearing all previous active sessions;
2. creating a fresh Windows browser/OAuth authentication;

still does NOT fix the Windows Codex refresh-token failure.

However:

1. clearing the previous active sessions;
2. authenticating Codex through Device Code in the official editor extension;
3. closing the editor;
4. reopening Windows Desktop without performing another browser/OAuth login;

currently restores working Windows Desktop Codex behavior.

Related reports with similar authentication symptoms include #39925 and #40820, but this report adds the Device Code authentication comparison and the successful clean-session recovery sequence described above.

I hope this reproduction and workaround help isolate the Windows authentication issue.

Start by reproducing the Windows browser/OAuth failure and comparing it with Device Code authentication through the official Codex extension in Cursor. Inspect the shared %USERPROFILE%\.codex\auth.json state and the authentication paths described in the report. Done means a fresh Windows browser/OAuth login can refresh access tokens normally without the revoked-token error, while preserving the working Device Code comparison.