Recover Codex sign-in without repeatedly reinstalling

1. Write down the failure before changing anything

Note the interface, operating system, client version, and the exact step that fails: opening sign-in, completing it in the browser, returning to Codex, or starting a task afterward. Keep a redacted error message. This makes your next attempt a checkable experiment instead of another full reinstall.

Use the desktop profile menu to check the active account or API key status. In the CLI, the commands below show the version and authentication method. A signed-in result alone does not prove that your chosen workspace permits the feature you want.

codex --version
codex login status

Reference: OpenAI: Authentication · OpenAI: Codex CLI

2. Confirm the access you intended to use

ChatGPT sign-in uses subscription access; API key sign-in uses separately billed API usage. Local clients support both, while Codex cloud requires ChatGPT sign-in. Do not create an API key merely to bypass an unexplained subscription sign-in problem.

Reference: OpenAI: Authentication

3. Retry the normal flow in the same environment

For CLI browser sign-in, run codex login and finish the flow it opens. On the desktop signed-out screen, choose Continue and complete the browser flow. Keep track of the account you choose, then return to the original client.

If you deliberately need to replace stored CLI credentials, codex logout clears them. The CLI and IDE extension share cached login details, so signing out can affect both. Save work first. Do not use logout as a generic fix for managed automation: when workload identity is selected, the process environment controls authentication and login/logout are rejected.

On Windows, a native CLI and a CLI inside WSL can use different home directories. Retry in the environment where the failure occurred. A successful login elsewhere does not by itself verify that environment.

codex login

Reference: OpenAI: Authentication · OpenAI: Windows desktop app

4. Handle a blocked browser handoff

For a remote or headless CLI, or a blocked localhost callback, OpenAI documents device-code authentication as a beta option. It must be enabled in your personal security settings or allowed by the workspace administrator. Follow the link and one-time code produced by your own CLI session; keep the code private.

If that option is unavailable, use the official authentication page's remote-login guidance or ask your administrator. Do not weaken TLS verification, change organization policy, or copy credential files into a chat to finish a login.

codex login --device-auth

Reference: OpenAI: Authentication

5. Stop at the boundary you cannot repair locally

An organization can enforce a login method or a particular ChatGPT workspace. Credentials that conflict with those restrictions can cause Codex to sign out and exit. Ask the administrator to confirm your allowed method and workspace instead of repeatedly reinstalling or deleting configuration.

If the error is certificate-related on a corporate network, ask IT for the approved CA configuration. If support requests login diagnostics, review and redact them before sharing. Authentication caches contain credentials and must stay out of tickets, repositories, and copied prompts.

Finish with one narrow check: confirm the expected authentication method, open a small intended project, and ask Codex to explain it without editing. If sign-in succeeds but tools or task execution still fail, record that as the next problem instead of restarting the login loop.

Reference: OpenAI: Authentication

Try it in Codex

Describe a sign-in failure safely

Help me diagnose a Codex sign-in failure using only the redacted facts I provide.

Interface and version: [desktop or CLI, version]
Environment: [macOS, native Windows, WSL, or remote CLI]
Intended method: [ChatGPT or API key]
Failure step and redacted error: [describe]

Separate authentication, workspace access, browser callback, and task/tool execution. Use current official OpenAI documentation. Suggest the smallest next check and what its result would prove. Do not read or print credential files, tokens, environment secrets, or one-time codes. Do not sign out, change account settings, install software, or modify configuration. If an administrator must act, explain the exact access question to ask.

Check your result

• You know which client, environment, and login method failed.
• A retry is checked in the same environment, with the intended account or workspace.
• You can run a small read-only task, or name the exact administrator/support blocker.
• No credentials, login codes, or unredacted diagnostic files were shared.

Sources and scope

Official references support the product behavior described above. The task prompts and practical checks are our community guidance.

• OpenAI: AuthenticationLogin methods, status/logout, cached credentials, managed restrictions, and beta device-code authentication.
• OpenAI: Codex CLIThe terminal client and versioned CLI workflow.
• OpenAI: Windows desktop appNative Windows and WSL environment boundaries.

Something changed in your version? Send a correction with the guide URL, platform, and version. Leave out credentials and private project content.