MCP OAuth: long-lived clients reuse rotated refresh tokens; refresh coordination prevents reproduction

What version of Codex CLI is running?

0.154.0-alpha.6.2

What subscription do you have?

PRO

Which model were you using?

Not applicable - reproduced via MCP calls without model turns.

What platform is your computer?

Windows NT 10.0.26200.0 x64

What terminal emulator and version are you using (if applicable)?

Originally observed in the Codex desktop app. Reproduced using Node.js spawning codex app-server over stdio; no terminal emulator involved.

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1789592535s since unix epoch",
  "overallStatus": "fail",
  "codexVersion": "0.154.0-alpha.6.2",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "<USER_HOME>\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "<USER_HOME>\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "<USER_HOME>\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "<USER_HOME>\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "<USER_HOME>\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "<USER_HOME>\\.codex\\auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "<USER_HOME>\\.codex",
        "active thread overrides": "not inspected",
        "config.toml": "<USER_HOME>\\.codex\\config.toml",
        "config.toml parse": "ok",
        "configuration load ms": "8",
        "configuration scope": "invocation config, including cloud-managed policy",
        "cwd": "<USER_HOME>\\Desktop\\<PROJECT>",
        "enabled feature flags": "<redacted>",
        "feature flag overrides": "mcp_oauth_refresh_coordination=true",
        "feature flags enabled": "50",
        "log dir": "<USER_HOME>\\.codex\\log",
        "mcp servers": "3",
        "model": "gpt-6-astra",
        "model provider": "openai",
        "sqlite home": "<USER_HOME>\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "desktop.app.version": {
      "id": "desktop.app.version",
      "category": "desktop",
      "status": "ok",
      "summary": "the desktop application is installed",
      "details": {
        "log directory": "$HOME\\AppData\\Local\\Codex/Logs",
        "running": "true",
        "version": "26.908.4834.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "desktop.app_server.handshake": {
      "id": "desktop.app_server.handshake",
      "category": "desktop",
      "status": "ok",
      "summary": "no desktop app-server handshake was recorded",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "desktop.security.enforcement": {
      "id": "desktop.security.enforcement",
      "category": "desktop",
      "status": "ok",
      "summary": "no locally visible recent Codex security enforcement was found",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git executable found; execution not verified",
      "details": {
        ".git entry": "directory",
        "PATH git #1": "C:\\Program Files\\Git\\cmd\\git.exe",
        "PATH git #2": "<USER_HOME>\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\native\\git\\cmd\\git.exe",
        "PATH git entries": "2",
        "git execution": "not inspected (PATH helpers are not executed)",
        "repo detected": "true",
        "repo root": "<USER_HOME>\\Desktop\\<PROJECT>",
        "selected git": "C:\\Program Files\\Git\\cmd\\git.exe"
      },
      "remediation": null,
      "durationMs": 15
    },
    "git.worktree.dev_drive": {
      "id": "git.worktree.dev_drive",
      "category": "git",
      "status": "warning",
      "summary": "this worktree is not on a Windows Dev Drive; moving it to a trusted Dev Drive can significantly improve repository and filesystem performance",
      "details": {},
      "remediation": "create a trusted Windows Dev Drive for source repositories: https://learn.microsoft.com/en-us/<redacted>",
      "durationMs": 0
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "<USER_HOME>\\AppData\\Local\\OpenAI\\Codex\\bin\\bffc5354119c8421\\codex.exe",
        "current executable": "<USER_HOME>\\AppData\\Local\\OpenAI\\Codex\\bin\\bffc5354119c8421\\codex.exe",
        "install context": "other",
        "managed by Vite+": "false",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed by pnpm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 14
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "MCP configuration is locally consistent",
      "details": {
        "configured servers": "3",
        "disabled servers": "1",
        "stdio servers": "2",
        "streamable_http servers": "1"
      },
      "remediation": null,
      "durationMs": 275
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "managed proxy": "not configured",
        "proxy env vars": "none",
        "respect system proxy": "disabled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT inference URL": "https://chatgpt.com/backend-api/<redacted> reachable (HTTP 405)",
        "desktop assets CDN": "https://persistent.oaistatic.com/codex-app-prod/<redacted> reachable (HTTP 200)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 124
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 0 IPv6, first IPv4",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 955
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running local build on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "<USER_HOME>\\AppData\\Local\\OpenAI\\Codex\\bin\\bffc5354119c8421\\codex.exe",
        "install method": "other",
        "platform": "windows-x86_64",
        "version": "0.154.0-alpha.6.2"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search command found (system); execution not verified",
      "details": {
        "search command": "rg.exe",
        "search command path": "<USER_HOME>\\AppData\\Local\\OpenAI\\Codex\\bin\\116cfc4fd47f015a\\rg.exe",
        "search command readiness": "found; execution not verified",
        "search provider": "system"
      },
      "remediation": null,
      "durationMs": 1
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "denied-read glob rules": "0",
        "denied-read restrictions": "false",
        "denied-read rules": "0",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "glob scan max depth": "unbounded",
        "managed filesystem source": "none",
        "network sandbox": "restricted",
        "sandbox backend": "elevated",
        "sandbox provisioning": "complete"
      },
      "remediation": null,
      "durationMs": 2
    },
    "security.endpoint": {
      "id": "security.endpoint",
      "category": "security",
      "status": "warning",
      "summary": "endpoint protection detected; Codex exclusions are unverified",
      "details": {
        "Codex exclusions": "not verified",
        "endpoint products": "Microsoft Defender",
        "exclusion targets": "signed Codex app; codex.exe; codex-windows-sandbox-setup.exe; codex-command-runner.exe; codex-code-mode-host.exe"
      },
      "issues": [
        {
          "severity": "warning",
          "cause": "Microsoft Defender can interfere with Codex. Verify Codex exclusions.",
          "measured": "not verified",
          "expected": "Codex application and helper exclusions",
          "remedy": "Microsoft Defender: Add a certificate or executable-path exclusion for Codex and its helpers. If Attack Surface Reduction blocks Codex, add a rule exclusion. If Controlled Folder Access blocks Codex, allow the app.",
          "fields": [
            "Codex exclusions"
          ]
        }
      ],
      "remediation": "ask your security administrator to verify Codex exclusions and required helper allowances",
      "durationMs": 33
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "<USER_HOME>\\.codex (dir)",
        "active rollout files": "176 files, 833549131 total bytes, 4736074 average bytes",
        "archived rollout files": "3 files, 2812397 total bytes, 937465 average bytes",
        "goals DB": "<USER_HOME>\\.codex\\goals_1.sqlite (file)",
        "goals DB <PROJECT>ty": "ok",
        "log DB": "<USER_HOME>\\.codex\\logs_2.sqlite (file)",
        "log DB <PROJECT>ty": "ok",
        "log dir": "<USER_HOME>\\.codex\\log (missing)",
        "memories DB": "<USER_HOME>\\.codex\\memories_1.sqlite (file)",
        "memories DB <PROJECT>ty": "ok",
        "queue DB": "<USER_HOME>\\.codex\\queue_1.sqlite (file)",
        "queue DB <PROJECT>ty": "ok",
        "sqlite home": "<USER_HOME>\\.codex (dir)",
        "state DB": "<USER_HOME>\\.codex\\state_5.sqlite (file)",
        "state DB <PROJECT>ty": "ok",
        "thread history DB": "<USER_HOME>\\.codex\\thread_history_1.sqlite (file)",
        "thread history DB <PROJECT>ty": "ok"
      },
      "remediation": null,
      "durationMs": 7913
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "warning",
      "summary": "rollout files and state DB thread inventory differ",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "176",
        "rollout DB active rows": "175",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "3",
        "rollout DB archived rows": "3",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread id sample": "<REDACTED_THREAD_ID>",
        "rollout DB duplicate rollout thread ids": "1",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "1",
        "rollout DB missing active sample": "<USER_HOME>\\.codex\\sessions\\2026\\09\\07\\rollout-2026-09-07T20-53-11-<REDACTED_THREAD_ID>.jsonl",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=178",
        "rollout DB rows": "178",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "subagent:other=144, vscode=34",
        "rollout DB stale rows": "0"
      },
      "issues": [
        {
          "severity": "warning",
          "cause": "rollout files are missing from the state DB",
          "measured": "1 active, 0 archived",
          "expected": "every rollout file has a matching threads row",
          "remedy": null,
          "fields": []
        },
        {
          "severity": "warning",
          "cause": "duplicate thread inventory entries found",
          "measured": "1 duplicate rollout thread ids, 0 duplicate DB paths",
          "expected": "one rollout path and thread id per thread",
          "remedy": "Attach the doctor report to a bug report so support can inspect samples.",
          "fields": []
        }
      ],
      "remediation": null,
      "durationMs": 199
    },
    "system.disk": {
      "id": "system.disk",
      "category": "disk",
      "status": "ok",
      "summary": "sufficient free disk space (22.2 GiB)",
      "details": {
        "CODEX_HOME available": "22.2 GiB",
        "failure threshold": "1.0 GiB",
        "warning threshold": "5.0 GiB",
        "worktree available": "22.2 GiB"
      },
      "remediation": null,
      "durationMs": 0
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language en-US",
      "details": {
        "EDITOR": "not set",
        "GH_PAGER": "set",
        "GIT_PAGER": "set",
        "LANG": "C.UTF-8",
        "LC_ALL": "C.UTF-8",
        "LC_CTYPE": "C.UTF-8",
        "PAGER": "set",
        "VISUAL": "not set",
        "os": "Windows 10.0.26200 (Windows 11 Core) [64-bit]",
        "os language": "en-US",
        "os type": "Windows",
        "os version": "10.0.26200"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "fail",
      "summary": "TERM=dumb - colors and cursor control are disabled",
      "details": {
        "COLORTERM": "present",
        "NO_COLOR": "1",
        "TERM": "dumb",
        "color output": "disabled (NO_COLOR)",
        "console input code page": "437",
        "console output code page": "65001",
        "effective locale": "C.UTF-8",
        "stderr console mode": "unavailable",
        "stderr is terminal": "false",
        "stdin is terminal": "false",
        "stdout console mode": "unavailable",
        "stdout is terminal": "false",
        "terminal": "dumb",
        "terminal size": "120x30"
      },
      "issues": [
        {
          "severity": "fail",
          "cause": "TERM=dumb - colors and cursor control are disabled",
          "measured": "TERM=dumb",
          "expected": "TERM=xterm-256color or another real terminal type",
          "remedy": "set TERM to a real value, for example xterm-256color",
          "fields": [
            "TERM"
          ]
        }
      ],
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "git repo root",
        "terminal title project value": "<PROJECT>",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "check for update on startup": "true",
        "desktop application": "OpenAI.Codex",
        "desktop latest build": "26.908.9136.0",
        "desktop update status": "available",
        "latest version": "0.154.0",
        "latest version status": "current version is not older",
        "update action": "manual or unknown",
        "version cache": [
          "<USER_HOME>\\.codex\\version.json",
          "missing"
        ]
      },
      "remediation": null,
      "durationMs": 403
    }
  }
}

What issue are you seeing?

Codex loses access to an OAuth-authenticated MCP server because long-lived clients sharing the same OAuth grant can reuse an already-consumed refresh token.

Originally observed in the Codex desktop app on Windows. Independently reproduced using Codex 0.154.0-alpha.6.2 app-server processes with a localhost OAuth/MCP server and fake credentials, without running model turns.

Observed behavior:

1. OAuth authorization succeeds.
2. One client refreshes successfully and receives a new access token and refresh token.
3. Another long-lived client submits the previous refresh token.
4. The OAuth server detects reuse and revokes the token family.
5. MCP requests fail with “Auth required”; subsequent refresh attempts return:
   invalid_grant: Refresh token revoked

In the production incident, the old refresh token was reused approximately 59 minutes after the successful rotation, outside the server’s 30-second retry grace period.

The local reproducer failed with refresh coordination disabled. With mcp_oauth_refresh_coordination enabled, a test involving 3 processes and 14 refreshes completed with zero stale-token reuses.

Users consequently need to reconnect their MCP integration despite having successfully authorized it earlier. Enabling the experimental flag is a local workaround, but ordinary users should not need to configure it manually.

What steps can reproduce the bug?

An isolated Node.js reproducer is attached. It uses a localhost OAuth/MCP server, fake credentials, an isolated CODEX_HOME, and ephemeral threads. It does not require an Omrela account or run model turns.

1. Save the attached codex-mcp-oauth-reproducer.txt as verify-codex-mcp-oauth.mjs.

2. Ensure Node.js and Codex 0.154.0-alpha.6.2 are available on PATH. Alternatively, set CODEX_BINARY to the Codex executable path.

3. Run with refresh coordination explicitly disabled:

   node verify-codex-mcp-oauth.mjs secrets long legacy

   The reproducer starts app-server processes sharing one OAuth grant, creates long-lived threads, and makes thread-bound MCP tool calls. It forces an HTTP 401 to trigger a refresh, then calls the MCP tool from another existing client.

   The legacy path reproduces reuse of a spent refresh token and an authentication failure.

4. Repeat with refresh coordination enabled:

   node verify-codex-mcp-oauth.mjs secrets long coordinated

   This also starts a third process and exercises repeated concurrent calls. Our test completed with 14 refreshes and zero stale-token reuses.

The failure was reproduced with both the encrypted Secrets backend and direct Windows keyring. Global resource reads alone did not reproduce it; thread-bound MCP tool calls did.

codex-mcp-oauth-reproducer.txt

What is the expected behavior?

Long-lived MCP clients sharing an OAuth grant should coordinate token refreshes and use the latest stored credentials.

After one client rotates the refresh token, other clients should reload the updated credentials before attempting another refresh, rather than submitting a spent token.

Concurrent calls, multiple open conversations, and process restarts should not cause token-family revocation or require users to sign in again while the authorization remains valid.

This should work with the default configuration, without requiring users to enable an experimental feature flag. Explicit revocation and genuine token expiry should still be respected.

Additional information

Related umbrella issue: #35006, particularly sections 2 and 7
on refresh-path coverage and shared credential lifecycle.

This report provides a concrete reproduction on Windows with
Codex 0.154.0-alpha.6.2: long-lived app-server clients reuse a
spent refresh token when coordination is disabled.

With

codex-mcp-oauth-reproducer.txt

enabled, our isolated test
completed 14 refreshes across 3 processes with zero stale-token
reuses.

Start at the MCP OAuth refresh-coordination path in the app-server, using MCP calls through the Node.js stdio reproduction described in the issue. Reproduce the long-lived-client flow with rotated refresh tokens and inspect the coordination behavior; done means clients no longer reuse an invalidated token and the reported scenario is covered by a regression test.