OpenAI Team,
I would like to propose an improvement to the authentication experience in the ChatGPT desktop application and local Codex/Work workflows.
This is not a request to remove security or anti-abuse protections.
The request is to prevent a mobile phone number from becoming the only possible authentication path when an account can already be securely verified through other methods.
The current problem
OpenAI’s current documentation says that phone verification is not generally required to create an OpenAI account or use ChatGPT.
However, users may be required to verify a phone number when accessing Codex through the ChatGPT desktop application.
In that verification flow, email verification or an authenticator app currently cannot replace the required phone verification step.
This creates a single point of failure for otherwise valid and secure accounts.
There are already multiple reports in the OpenAI Community and the official openai/codex GitHub repository describing situations where:
-
ChatGPT Web works normally, but the desktop/Codex authentication flow redirects to
/add-phone; -
users have active Plus or Business subscriptions but still cannot complete desktop authentication;
-
users no longer have access to an old phone number;
-
a mobile carrier has retired or reassigned a number;
-
valid numbers cannot receive OpenAI’s verification SMS;
-
a number is rejected as already used;
-
employees do not have corporate mobile numbers and do not want to attach personal phone numbers to company-managed accounts;
-
authenticator MFA, passkeys, Google authentication, email verification, or trusted authenticated sessions already work, yet none of them can replace the phone requirement.
Related reports include:
“Windows ChatGPT Desktop forces ‘Phone number required’ while Web works normally — no mobile number, no alternative login”
“Unable to Sign In to ChatGPT Desktop on macOS Because SMS Verification Is the Only Login Option”
“ChatGPT Team Workspace: Phone verification required for Codex/Desktop App?”
“Codex sign-in asks for phone verification on paid account”
“Request to Allow Phone Number Replacement for ChatGPT Accounts”
openai/codex GitHub issue #24990 — “Codex ChatGPT login flow”
openai/codex GitHub issue #45647 — “Windows Codex login redirects to add-phone and rejects existing phone number”
This makes the issue broader than one account or one operating system.
Phone numbers are not permanent identities
A phone number is useful as a security and anti-abuse signal, but it is not a permanent identity credential.
People:
move between countries;
change mobile carriers;
lose SIM cards;
have numbers deactivated after long periods abroad;
receive recycled telephone numbers;
use different personal and business accounts;
use several computers;
work for companies that do not issue corporate mobile phones;
or simply prefer not to attach a personal telephone number to a business account.
There is an additional problem: OpenAI currently does not provide a way to change or update the phone number associated with an account.
That means an old telephone number can eventually become an authentication dependency that the legitimate account owner has no way to repair.
For users who rely on ChatGPT and Codex professionally, this can turn into an account-access problem rather than merely an inconvenience.
OpenAI already has strong alternative authentication methods
OpenAI already supports several strong authentication mechanisms elsewhere in its account system:
Email one-time passwords
Authenticator applications
Passkeys
Hardware security keys
Push approval on trusted devices
Passwords where supported
Google / Microsoft / Apple authentication
Advanced Account Security
Recovery keys
Some of these methods are cryptographically stronger against phishing and SIM-swap attacks than SMS authentication.
Therefore, I believe these existing security mechanisms could be used to provide a secure fallback instead of making possession of a specific mobile number an absolute requirement.
Proposed solution
Please keep phone verification available, but make it one verification option rather than the only possible option for established accounts.
When additional verification is required in ChatGPT Desktop, Codex, or related local workflows, the interface could display:
“Verify your identity”
and then provide appropriate choices based on the account:
Use a passkey
Use authenticator app
Send a code to verified email
Approve from a trusted ChatGPT device
Use a hardware security key
Use SMS / WhatsApp
Use an organization SSO method
Use a recovery method where appropriate
Phone verification could still be mandatory in genuinely high-risk or anti-abuse situations if necessary.
But for an established account with a verified email, successful MFA, passkey, paid subscription, trusted devices, or organizational authentication, there should be a secure alternative.
Risk-based verification would be better than phone-only verification
A more flexible model could use risk-based authentication.
For example, an established account signing in from a known computer with a passkey and authenticator MFA should not necessarily have the same verification requirements as a new anonymous account exhibiting suspicious behavior.
OpenAI could still apply stronger verification when its risk systems determine that it is needed.
The important difference is that legitimate users would have a recovery path.
Please also allow users to update their phone number
Even if phone verification remains part of the system, users need a secure way to replace an obsolete number.
A secure change process could require:
existing MFA or passkey verification;
verification of the new number;
email confirmation;
a security notification;
a temporary security hold;
or additional checks for suspicious changes.
A telephone number should not become permanently attached to an account with no supported update mechanism.
My personal use case
I use ChatGPT for serious long-running technical work across multiple computers and accounts.
For this kind of workflow, email-based authentication, authenticator applications, passkeys, or confirmation codes are substantially more reliable for me than dependence on a particular SIM card.
A user may spend months outside the country where a mobile number was issued. Some carriers may eventually deactivate an unused number.
The user may still control:
their email account;
their password;
their passkeys;
their authenticator;
their trusted computers;
their paid subscription;
and their existing ChatGPT sessions.
Losing one SIM card should not invalidate all of those proofs of account ownership.
This becomes even more important as ChatGPT Desktop combines increasingly important ChatGPT, Work, local-file, and Codex workflows.
For many users, the desktop application is becoming a professional working environment rather than an optional companion application.
The request
Please consider the following principle:
Phone verification should remain available as an important security and anti-abuse mechanism, but an established user should not be permanently blocked solely because one telephone number is unavailable when other strong account-verification methods exist.
The ideal experience would be:
Phone number — available, but not the only path.
Email OTP — available.
Authenticator — available.
Passkey/security key — available.
Trusted-device approval — available.
Enterprise/Business authentication — respected.
Secure phone-number replacement — available.
Risk-based additional verification — used when genuinely necessary.
This would preserve security while making account access much more resilient for travelers, international users, professionals with several devices, companies, users with multiple legitimate accounts, and anyone whose phone number changes over time.
Security should provide multiple strong ways to prove account ownership rather than create a permanent dependency on a single external identifier that users may eventually lose.
Thank you for considering this improvement.
Respectfully,
Vladimir & ChatGPT
working together on long-running technical and creative projects