[Windows][Codex Desktop][Auth] Advanced Account Security causes successful login to fail with HTTP 401 / auth_token_missing
I am reporting a reproducible authentication issue with Codex Desktop on Windows when Advanced Account Security (AAS) is enabled on my ChatGPT account.
I have reproduced the issue multiple times and performed an A/B test by changing only the Advanced Account Security state.
Summary
With Advanced Account Security enabled, Codex Desktop successfully completes the ChatGPT authentication flow, including hardware-based authentication.
The browser reports that the login is successful, and Codex Desktop initially recognizes the account as authenticated and opens the workspace normally.
However, shortly afterward, Codex loses authentication and returns to the sign-in screen.
With Advanced Account Security disabled, the same ChatGPT account on the same Windows PC and same Codex Desktop installation remains authenticated and works normally.
A/B reproduction
Advanced Account Security: ON
Result:
ChatGPT authentication succeeds
→ Codex receives authenticated account
→ authenticatedAccountPresent=true
→ account settings request returns HTTP 401
→ auth_token_missing
→ account_info_token_unavailable
→ authenticatedAccountPresent=false
→ Codex returns to sign-in
This behavior is reproducible.
Advanced Account Security: OFF
Same:
Result:
Login succeeds
→ Codex remains authenticated
→ Codex works normally
The only intentional change between these two tests was the Advanced Account Security state.
Environment
-
Platform: Windows
-
Application: Codex Desktop
-
Package observed in diagnostic log: OpenAI.Codex_26.818.5229.0_x64
-
Authentication: Sign in with ChatGPT
-
Advanced Account Security: Enabled when the failure occurs
-
Authentication method: hardware-based authentication
-
VPN/proxy: None enabled during testing
Diagnostic evidence
The diagnostic log confirms that the initial login succeeds:
account_login_completed ... success=true
Codex then recognizes the account as authenticated:
authenticatedAccountPresent=true
authMethod=chatgpt
failureType=undefined
result=succeeded
So this does not appear to be a failure of the initial browser/OAuth authentication.
The failure occurs afterward.
Codex later makes an authenticated request to the account settings endpoint and receives HTTP 401:
desktop_fetch_auth_401
hadToken=true
target="GET https://chatgpt.com/backend-api/accounts/:param/settings"
tokenSource=cached
willRetry=true
Immediately afterward:
authMethod=chatgpt
hasToken=false
nullReason=auth_token_missing
refreshToken=true
tokenExpiryState=missing
The following authenticated request then fails with:
Missing valid access token or actor biscuit
status=401
Finally, Codex reports:
authenticatedAccountPresent=false
authMethod=chatgpt
failureType=account_info_token_unavailable
result=failed
At that point, the application returns to the signed-out state.
Important observation
The interesting part is that the log reports:
hasToken=false
nullReason=auth_token_missing
refreshToken=true
tokenExpiryState=missing
So the initial authentication succeeds and a refresh token is still reported as present, but the desktop application subsequently loses the usable authenticated state after the 401 response.
Codex runtime itself starts normally
The diagnostic log also shows that the bundled Codex app-server starts successfully:
stdio_transport_spawned
Transport start success
initialize_handshake_result ... outcome=success
Codex CLI initialized
Therefore, this does not appear to be a simple Codex runtime startup failure.
Expected behavior
Advanced Account Security should be compatible with Codex Desktop authentication.
After successfully completing hardware-backed authentication, Codex Desktop should maintain the authenticated session or correctly perform any reauthentication/token refresh required by AAS.
Actual behavior
With AAS enabled:
Successful authentication
→ temporary authenticated state
→ HTTP 401
→ access token unavailable
→ auth_token_missing
→ account_info_token_unavailable
→ signed out
With AAS disabled:
Successful authentication
→ authenticated session remains active
→ Codex works normally
What this evidence establishes
I am not claiming that the logs prove whether the root cause is client-side or server-side.
What I can reproduce is:
AAS enabled → authentication consistently fails shortly after a successful login.
AAS disabled → the same account and same Windows installation work normally.
This appears to be a compatibility issue somewhere in the authentication/token lifecycle between Advanced Account Security and Codex Desktop on Windows.
I have already reported this to OpenAI Support and can provide the complete diagnostic log privately if requested.
I am intentionally not posting the full raw log publicly because it contains account-specific identifiers and local system information.
Questions for OpenAI / other users
-
Is this a known issue with Advanced Account Security and Codex Desktop on Windows?
-
Has anyone else reproduced the same 401 → auth_token_missing → account_info_token_unavailable sequence?
-
Is the immediate loss of the access token after successful AAS authentication expected behavior?
-
Is there a supported workaround that does not require disabling Advanced Account Security?
I would prefer not to weaken my account security simply to keep Codex Desktop authenticated.
If anyone with AAS enabled can reproduce this on Windows, please share your sanitized logs and Codex version so we can determine whether this affects multiple accounts.
reaction on the GitHub issue itself—not only on this forum topic. Reactions on GitHub can help the developers gauge the number of affected users.