Windows Codex Desktop enters authentication loop (access token could not be refreshed) while Codex CLI remains logged in and works normally

What version of the Codex App are you using (From “About Codex” dialog)?

26.908.4834.0

What subscription do you have?

plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Codex Desktop repeatedly shows:

Your access token could not be refreshed because you have since logged out or signed in to another account. Please sign in again.

Signing out and signing back in does not fix the issue.

The interesting part is that the Codex CLI on the same Windows machine, using the same ChatGPT account, remains authenticated and can successfully make model requests.

For example:

PS C:\Users\admin> codex

› hello

⚠ Falling back from WebSockets to HTTPS transport. request timed out

• Hello! How can I help?

Immediately afterwards:

PS C:\Users\admin> codex login status
Logged in using ChatGPT

However, Codex Desktop still reports the refresh-token error.

Expected behavior

After successfully signing in with ChatGPT, Codex Desktop should use the valid authenticated session and remain logged in.

If the CLI/Core authentication is valid, the Desktop application should not independently enter a permanent unauthenticated state.

Actual behavior

Codex Desktop initially makes authenticated requests, receives a 401 token_expired, and then appears to lose its local authentication state.

After that, subsequent Desktop requests are sent without an attached access token:

desktop_fetch_auth_401
hadToken=false
skipRetryReason=no_token_attached
tokenSource=cached
willRetry=false

The application then remains stuck in a sign-in / refresh-token error loop.

Relevant log sequence

At approximately 2026-09-15T08:13:41Z, Codex Desktop receives:

Request failed with status 401 Unauthorized

"message": "Provided authentication token is expired. Please try signing in again."
"code": "token_expired"

Shortly afterwards, Desktop requests change to:

desktop_fetch_auth_401
hadToken=false
skipRetryReason=no_token_attached
tokenSource=cached
willRetry=false

This occurs for several ChatGPT backend endpoints, including:

/backend-api/.../home
/backend-api/settings/user
/backend-api/wham/...
/backend-api/wham/tasks/list
/backend-api/wham/usage

The same token_expired behavior appears again in later Desktop processes, so this is reproducible rather than a one-time request failure.

For example, another Desktop process at approximately 08:34:52Z and 08:35:00Z again receives:

401 Unauthorized
code: token_expired

Later, another process at approximately 08:54:11Z again sends requests with:

hadToken=false
skipRetryReason=no_token_attached

Authentication state comparison

After reproducing the Desktop failure:

PS C:\Users\admin> codex login status
Logged in using ChatGPT

The CLI can also successfully send a prompt and receive a model response.

Therefore:

ChatGPT OAuth / account
↓
Codex CLI/Core
↓
works

while:

Codex Desktop
↓
401 token_expired
↓
Desktop auth state becomes hadToken=false
↓
subsequent requests contain no token
↓
Desktop displays refresh-token error
Troubleshooting already attempted

The following were tested and did not resolve the Desktop issue:

Sign out from Codex Desktop and sign in again.
Fully close and restart Codex Desktop.
Re-authenticate the ChatGPT account.
Tried an alternative Device Code / Cursor Codex authentication path.
Checked Windows environment variables for:
CODEX_*
OPENAI_*
CHATGPT_*

No matching environment variables were present.

Command used:

Get-ChildItem Env: | Where-Object {
$_.Name -match 'CODEX|OPENAI|CHATGPT'
}

It returned no entries.

Checked Codex configuration for overrides such as:
cli_auth_credentials_store
forced_login_method
chatgpt_base_url
model_provider

No matching custom configuration was present.

Before re-running codex login, there was no:
C:\Users\admin.codex\auth.json

and:

codex login status

reported:

Not logged in

After running codex login, authentication succeeds and CLI usage works normally.

Additional observation

The Desktop logs suggest the important transition is not merely "refresh token rejected."

The visible sequence is:

authenticated request
↓
401 / token_expired
↓
Desktop auth state changes
↓
hadToken=false
↓
no_token_attached
↓
Desktop stops retrying authenticated requests

The log explicitly reports:

hadToken=false
skipRetryReason=no_token_attached
willRetry=false

for multiple requests after the original authentication failure.

This makes it look like Desktop's authentication/session state diverges from the underlying Codex CLI/Core authentication state.

Reproduction
Install/open Codex Desktop 26.908.4834.0 on Windows 11.
Sign in using a ChatGPT account.
Open/use Codex Desktop.
Desktop eventually reports:
Your access token could not be refreshed because you have since logged out or signed in to another account. Please sign in again.
Open PowerShell on the same machine.
Run:
codex login
Complete ChatGPT OAuth.
Run:
codex login status

Result:

Logged in using ChatGPT
Run:
codex
Send:
hello

CLI successfully returns a model response.

Return to Codex Desktop.

Desktop still reports the refresh-token authentication error.

Impact

Codex Desktop is unusable because it repeatedly enters an authentication loop, even though the same account and the underlying Codex CLI/Core authentication are working correctly.

This appears to be specific to the Windows Desktop authentication/session handling rather than a general account or OAuth failure.

What steps can reproduce the bug?

I don't know

What is the expected behavior?

Desktop successfully returns a model response.

Additional information

No response

Start by tracing the Codex Desktop authentication/session handling around the reported 401 token_expired transition and compare it with the working CLI/Core login state. Use the desktop log sequence, especially hadToken=false and no_token_attached, to reproduce the failure; done means Desktop retains or restores valid authentication and no longer enters the sign-in loop while CLI/Core remains logged in.