Windows Desktop: previously working paid Business account gets refresh token revoked; passkey succeeds, then /add-phone rejects already-verified phone

What version of the Codex App are you using?

Incident build:
26.908.9136.0

Currently installed build:
26.911.7940.0

The issue still reproduces on the current build.

What subscription do you have?

ChatGPT Business — active paid seat.

The same OpenAI identity also had a Personal workspace that was on Pro through 2026-09-16 and transitioned to Free on 2026-09-17.

The Business workspace remained active and paid throughout.

I am not claiming the Pro -> Free transition is the root cause, but the timing may be relevant to an account-entitlement/authentication state transition.

What platform is your computer?

Windows x64, Codex Desktop.

Summary

Codex Desktop had been working normally with this account until 2026-09-16.

On 2026-09-17, when I attempted to use Codex Desktop again, the existing Codex authentication session failed.

The local Desktop logs show:

• authenticated API calls began returning 401 Unauthorized
• the client reported that the refresh token had been revoked
• Codex immediately initiated a new account login
• the login attempts completed with success=false

During the browser-based reauthentication flow, I successfully complete authentication using my existing passkey/security-key setup.

However, immediately after the passkey step, the Codex authentication flow incorrectly redirects the already-established account to:

https://auth.openai.com/add-phone

This account already has a previously verified phone number.

Entering that same previously verified phone number results in:

This phone number is already in use. Please use a different phone number.

This creates an authentication deadlock:

• Codex/Auth treats the existing account as requiring new phone enrollment
• the phone system simultaneously recognizes that the phone number is already registered
• authentication cannot complete
• I never reach Personal/Business workspace selection

The same OpenAI account continues to work normally in ChatGPT Web and the iPhone app.

Timeline

Last known working:
2026-09-16

Personal workspace transition:
Pro -> Free on 2026-09-17

Business workspace:
remained active as a paid Business workspace

First observed Codex failure:
approximately 2026-09-17 09:51 KST (UTC+9)

Relevant local log sequence:

09:50:41.024 KST  /wham/usage status=401 Unauthorized

09:50:41.276 KST  /wham/tasks/list status=401 Unauthorized

09:50:41.733 KST  Failed to refresh token:
                  Your access token could not be refreshed because your refresh token was revoked.
                  Please log out and sign in again.
                  target=codex_login::auth::manager

09:50:43.615 KST  method=account/login/start

09:53:25.597 KST  account_login_completed success=false

09:58:45.653 KST  method=account/login/start

09:59:15.907 KST  account_login_completed success=false

The client discovered the revoked refresh-token state at approximately 09:50:41 KST.

This does not necessarily mean the token was revoked at that exact moment; it may have been revoked earlier and only discovered when Codex attempted to use/refresh it.

Actual Windows Desktop log location

The incident-time logs were found under:

%LOCALAPPDATA%\Codex\Logs\2026\09\17\

The older file:

%USERPROFILE%\.codex-b\log\codex-login.log

was not useful for this incident. It was last modified on 2026-08-20 and only contained three older codex_cli::login: starting browser login flow records.

Browser authentication behavior

During the failed account reauthentication:

1. Launch Codex Desktop.
2. Select Sign in with ChatGPT.
3. Authenticate the existing OpenAI account.
4. Complete the existing passkey/security-key authentication successfully.
5. Instead of completing OAuth or allowing workspace selection, authentication redirects to:
   https://auth.openai.com/add-phone
6. Enter the phone number that was already verified on this account.
7. The enrollment page rejects it because it is already in use.
8. Codex authentication cannot complete.

Important detail

The Desktop logs themselves do not contain:

• auth.openai.com
• /add-phone
• phone
• verification
• enrollment
• challenge

The /add-phone behavior is observed in the browser authentication flow, suggesting that this part of the failure is occurring in the OpenAI authentication service rather than the local Desktop logger.

Account-state observations

During the incident window, timestamped account-registry backup files were also created under:

%USERPROFILE%\.codex\accounts\

The current registry.json contains no active account key/account array.

I am not claiming causality between these registry changes and the authentication failure, but the timestamps overlap with the failed authentication attempts and may be useful for diagnosis.

Expected behavior

After successful passkey authentication, an existing account with an already verified phone factor should complete normal Codex authentication and proceed to workspace selection.

If a phone factor needs to be verified, the authentication flow should challenge the existing verified factor rather than attempting to enroll the same phone number as a new factor.

The active paid Business workspace should remain accessible even though the Personal workspace transitioned from Pro to Free.

Actual behavior

Existing working Codex session becomes unusable.

The client discovers a revoked refresh token and forces reauthentication.

Passkey authentication succeeds.

The authentication service then routes the existing account into new-phone enrollment at /add-phone.

The already verified phone number is rejected as already in use.

Authentication terminates with account_login_completed success=false.

Updating Codex Desktop from 26.908.9136.0 to 26.911.7940.0 does not resolve the problem.

Why this may be useful

This appears to combine symptoms previously reported separately:

• existing verified account routed to phone enrollment after passkey authentication
• Windows Desktop refresh-token revocation / recovery failure
• account/subscription state transition close to the time authentication stopped working

Please investigate whether:

1. an account-entitlement transition caused session invalidation or refresh-token revocation;
2. the existing phone-verification state became inconsistent with the Codex OAuth/account state;
3. Codex reauthentication is incorrectly selecting the new-phone enrollment path instead of challenging the existing phone factor;
4. an account-level authentication/risk state can cause this incorrect enrollment flow;
5. paid Business workspace entitlement is being lost or incorrectly evaluated before workspace selection.

Related reports

Similar phone-enrollment behavior:
#34934
#39467

Similar Windows refresh-token/auth recovery behavior:
#40820
#41405
#40633

The important difference in this report is the observed sequence on one Windows account:

previously working Codex
→ 401
→ refresh token revoked
→ forced reauthentication
→ passkey succeeds
→ /add-phone
→ already-verified phone rejected as already in use
→ login fails

Additional information

• ChatGPT Web continues to work with the same account.
• ChatGPT iPhone app continues to work with the same account.
• Existing passkey/security-key authentication works.
• Business workspace remains active and paid.
• No account-deactivation/suspension notification has been received.
• No credentials, tokens, phone number, or email address are included in this report.

A support case is already open, and I can provide additional sanitized logs privately if needed.

Start with the incident-time logs under %LOCALAPPDATA%\Codex\Logs\2026\09\17\ and the account/login/start entries, comparing the 401 and revoked-refresh-token sequence with the failed browser reauthentication. Done means determining whether Codex or the external authentication service routes an existing verified account to /add-phone instead of completing authentication and workspace selection.