# Codex login not working? Every sign-in error, fixed

> Codex login not working? Match your error: port 1455 busy, no browser on a server, refresh token already used, or a config.toml that logs you out.

Source: https://shuriken.sh/guides/codex-login-not-working

Most Codex sign-in failures come down to five things: the browser can't reach Codex's callback on localhost:1455, you're on a machine with no browser, device code login is switched off, two Codex processes spent one refresh token, or config.toml only allows another login method or workspace.

By Shuriken Updated 27 October 2026 8 min read

**Contents**

When Codex login is not working, the message usually names the cause. A browser that never hands the sign-in back means it can't reach Codex's callback on localhost:1455. On a server with no browser, use codex login --device-auth. "Refresh token was already used" means two Codex processes shared one sign-in. And "Logging out" right after start means config.toml allows a different login.

We read every message below in OpenAI's [authentication docs](https://learn.chatgpt.com/docs/auth) and in Codex's open-source code (release 0.164.0, out on 23 October 2026) on 24 October 2026. Find yours, then jump to its fix.

| What Codex prints | Section |
| --- | --- |
| The browser says you're signed in, the terminal keeps waiting | The callback on port 1455 |
| Port 127.0.0.1:1455 is already in use (or :1457 ) | The callback on port 1455 |
| device code login is not enabled for this Codex server | Device code login |
| …because your refresh token was already used. Please log out and sign in again. | Refresh token errors |
| ChatGPT login is required, but an API key is currently being used. Logging out. | Codex keeps logging you out |
| Codex is not enabled for your workspace | Codex keeps logging you out |

## The browser signs in but Codex never hears back (port 1455) #

codex login opens ChatGPT's sign-in page and, at the same moment, starts a small web server on your computer to catch the answer. The tokens come back on one request, the sign-in's last redirect to http://127.0.0.1:1455/auth/callback. Put a busy port, a browser on another machine or a proxy in the way and you get an odd half-success: ChatGPT says you're signed in, the terminal keeps waiting.

The first line Codex prints is Starting local login server on http://localhost:1455, with a long URL under it. No browser window? Paste that URL into a browser on the same computer.

Another program holding the port gives you Port 127.0.0.1:1455 is already in use. A stale codex login is rarely the one, since Codex asks an older login on that port to cancel before it gives up; lsof -i :1455 names the real owner on macOS and Linux.

Codex releases built after a change merged on 29 April 2026 move to port 1457 when 1455 stays busy ([PR #19334](https://github.com/openai/codex/pull/19334)). The "Starting local login server" line tells you which port it took. On those releases the error names 1457, and only appears when both ports are taken. Update Codex if yours fails on 1455 with no fallback.

On a corporate network with a TLS proxy or a private root CA, export CODEX_CA_CERTIFICATE with the path to a PEM bundle, then log in. In OpenAI's docs that one variable is read for login, for ordinary HTTPS requests and for WebSocket connections; when it's unset, Codex falls back to SSL_CERT_FILE.

bash
export CODEX_CA_CERTIFICATE=/path/to/corporate-root-ca.pem
codex login

Every direct codex login run also writes a codex-login.log file into Codex's log folder. That file is what to read, or attach to a bug report, when none of the above explains the failure.

## Codex login on a headless server (device auth) #

Over SSH there is no browser on the machine, and the callback has nowhere to land. OpenAI's docs give three ways in, and device code login is the one they prefer.

bash
codex login --device-auth

What comes back is a link and a one-time code marked "(expires in 15 minutes)". Open the link on a phone or laptop, sign in to ChatGPT there and type the code. Under the code Codex adds: "Continue only if you started this login in Codex. If a website or another person gave you this code, cancel." Enter only a code your own terminal printed.

Device code login is a beta and ships switched off. On a personal account you turn it on in ChatGPT's security settings; in a workspace, the admin turns it on in the workspace permissions. Until then the request for a code comes back as not found and Codex stops with device code login is not enabled for this Codex server. Use the browser login or verify the server URL. Switch it on and run the command again, or take one of the two fallbacks below.

The first fallback is an SSH tunnel for the callback. Open the session with -L 1455:localhost:1455, run codex login on the server and paste the URL it prints into the browser on your laptop. The redirect to localhost:1455 lands on the laptop and goes down the tunnel to the server (forward 1457 instead if Codex fell back to it).

bash
ssh -L 1455:localhost:1455 user@remote

The second is to copy the login itself. Sign in on a computer that has a browser and copy ~/.codex/auth.json to the same path on the server. OpenAI says to treat that file like a password, because it holds access tokens, and it only exists when Codex keeps credentials in a file. cli_auth_credentials_store in config.toml decides that:

- file writes auth.json
- keyring uses the system's credential store
- auto uses the credential store when there is one, and auth.json when there isn't

Use the copy on one machine only. Two machines refreshing the same login is the most common way to end up in the next section.

## "Refresh token was already used" #

The full message is Your access token could not be refreshed because your refresh token was already used. Please log out and sign in again. Codex refreshes a ChatGPT sign-in by itself while you work, and a refresh token that has already been spent on a refresh can be refused. So the error almost always means a second Codex got to the same login first.

When a user reported this in [issue #9634](https://github.com/openai/codex/issues/9634), a Codex maintainer at OpenAI asked whether "an another older copy of codex (either the CLI or IDE extension)" was "running for a while in the background". Later in the thread he described the other cause: Codex is "not designed to support usage of multiple concurrent instances of Codex on the same system with different logins". Signing in a second account rewrites auth.json, and the Codex processes started under the first account can't refresh any more. [PR #11802](https://github.com/openai/codex/pull/11802), merged on 18 February 2026, closed two gaps in the refresh logic, and the issue was closed on 29 March 2026 with the note that 0.117.0 should fix it.

- Update Codex to the latest release, so you have those fixes.
- Quit every Codex process: other terminals, the IDE extension, and any Codex left running in tmux or on a server you copied auth.json to.
- Run codex logout, then codex login.
- From then on, one login per auth.json. For a second account, give it its own folder with CODEX_HOME instead of logging in over the first; [switching Codex accounts without logging out](https://shuriken.sh/guides/codex-cli-switch-account) has the commands.

Codex has close relatives of this message, and the fix is the same: the refresh token "has expired", "was revoked", or the bare "could not be refreshed". Since PR #11802 there is a clearer one too: …because you have since logged out or signed in to another account. Please sign in again. One more trap: in 0.164.0, codex login first signs out the login already stored and asks OpenAI to revoke its tokens. Any Codex still running on that login, including a server holding a copied auth.json, should expect a refresh error next.

Shuriken moves a running chat to another of your own accounts when one reaches its limit, on every device.

[Download](https://shuriken.sh/download)

## Why Codex keeps logging you out #

A Codex that starts, prints a line ending in Logging out. and quits is doing what config.toml tells it. Two keys pin the login method and the workspace, and in a managed setup an admin may have set them, not you.

toml
forced_login_method = "chatgpt" # or "api"
forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"

When the active credentials don't match, OpenAI's docs say "Codex logs the user out and exits." The message tells you which key tripped. ChatGPT login is required, but an API key is currently being used, or the reverse, comes from forced_login_method; Login is restricted to workspace(s) …, but current credentials belong to … comes from forced_chatgpt_workspace_id. Sign in the way the file asks, or delete the line if it's yours. [Our config.toml guide](https://shuriken.sh/guides/codex-cli-config-toml) shows where Codex reads the file from.

Two other things look like being logged out. The CLI and the IDE extension share one cached login, so signing out in one signs out the other. And when a ChatGPT workspace hasn't turned Codex on for you, the sign-in itself stops with Codex is not enabled for your workspace. Contact your workspace administrator to request access to Codex. Only that admin can change it.

## Codex login with an API key instead of ChatGPT #

Pipe the key in through stdin, so the key itself never appears in the command you type:

bash
printenv OPENAI_API_KEY | codex login --with-api-key

Codex answers API key saved. Authentication is checked when you send a request., so a wrong key only shows up on your first message. This replaces the ChatGPT sign-in stored in that CODEX_HOME. codex login status tells you which one is active, and codex login takes you back to ChatGPT. If you're switching because ChatGPT's limit ran out, what to do when Codex hits its usage limit compares this with waiting or buying credits.

## How Shuriken keeps Codex sign-ins apart #

Most of these errors start with two logins sharing one auth.json. In Shuriken every ChatGPT account you add is a source with its own CODEX_HOME folder, and every Codex started in one of those folders gets -c cli_auth_credentials_store="file" on its command line; in our code that's CODEX_FILE_AUTH_ARGS in provider-specs.ts. Even if your own config.toml says keyring or auto, each sign-in then stays in its folder's auth.json and none goes to the system's credential store. Your config.toml is linked into each folder. Signing in a second account never overwrites the first. Only add accounts you own and are entitled to use; providers' terms may not allow sharing a subscription sign-in.

Shuriken's own refreshes go one at a time. A sign-in that Codex already has on the computer is offered in Sources as "Add you@… to Shuriken?". Shuriken then reads that login's current token before each chat and leaves the refreshing to Codex, so the token isn't spent from two places. For sign-ins it owns, Shuriken refreshes a token close to expiry before a chat starts, under a lock per sign-in that every Shuriken process on the computer honours, and reads the token again under that lock, skipping the refresh if another process already did it.

A refresh error that still shows up in a chat counts as a refused sign-in in Shuriken, not a limit or a network blip:

- Shuriken checks the token that source holds, with a request that doesn't refresh it.
- If that check is refused too, the chat moves to another of your sources that can take it, and the refused one shows Sign in again.
- One refusal the check doesn't confirm moves nothing.

How that works, and when it started, is in [a refused account no longer ends your chat](https://shuriken.sh/blog/how-switching-picks-the-next-account). To try it, [download Shuriken](https://shuriken.sh/download) and add your ChatGPT accounts under Sources.

Share

[X](https://x.com/intent/post?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fcodex-login-not-working&text=Codex%20login%20not%20working%3F%20Every%20sign-in%20error%2C%20fixed)[LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fcodex-login-not-working)[Hacker News](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fshuriken.sh%2Fguides%2Fcodex-login-not-working&t=Codex%20login%20not%20working%3F%20Every%20sign-in%20error%2C%20fixed)[Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fcodex-login-not-working&title=Codex%20login%20not%20working%3F%20Every%20sign-in%20error%2C%20fixed)[E-mail](mailto:?subject=Codex%20login%20not%20working%3F%20Every%20sign-in%20error%2C%20fixed&body=https%3A%2F%2Fshuriken.sh%2Fguides%2Fcodex-login-not-working)

## Sources

- [OpenAI: Codex authentication](https://learn.chatgpt.com/docs/auth) (accessed 24 October 2026)
- [openai/codex issue #9634: refresh token was already used](https://github.com/openai/codex/issues/9634) (accessed 24 October 2026)
- [openai/codex PR #11802: Fixed a hole in token refresh logic for app server](https://github.com/openai/codex/pull/11802) (accessed 24 October 2026)
- [openai/codex PR #19334: Fallback login callback port when default is busy](https://github.com/openai/codex/pull/19334) (accessed 24 October 2026)
- [openai/codex on GitHub: codex-rs/login/src/auth/manager.rs (refresh and workspace messages)](https://github.com/openai/codex/blob/main/codex-rs/login/src/auth/manager.rs) (accessed 24 October 2026)
- [openai/codex on GitHub: codex-rs/login/src/device_code_auth.rs](https://github.com/openai/codex/blob/main/codex-rs/login/src/device_code_auth.rs) (accessed 24 October 2026)

## Frequently asked questions

**Why does Codex say my refresh token was already used?**

Another Codex got to the refresh token first. In issue #9634 that was an older CLI or IDE extension left running in the background, or a second login that rewrote auth.json. Update Codex, quit the other Codex processes, then run codex logout and codex login.

**What port does codex login use?**

localhost:1455, where Codex runs a small callback server for the browser to hand the sign-in back to. Builds with PR #19334, merged on 29 April 2026, try 1457 when 1455 stays busy.

**How do I log in to Codex on a server with no browser?**

With codex login --device-auth. It prints a link and a one-time code; open the link on any device and type the code within 15 minutes. Device code login is a beta that has to be switched on first, in your ChatGPT security settings or by a workspace admin.

**Why does Codex keep logging me out?**

If config.toml sets forced_login_method or forced_chatgpt_workspace_id and your sign-in doesn't match, Codex prints a line ending in Logging out. and exits. The IDE extension and the CLI share one cached login, so logging out of either one logs out both.

**Can I log in to Codex with an API key instead of ChatGPT?**

Yes: printenv OPENAI_API_KEY | codex login --with-api-key. The key takes the place of the ChatGPT sign-in stored in that CODEX_HOME, and codex login status shows which of the two is active.

Source switching

One account runs dry. The next one takes over.

Add the Claude, Codex and Gemini accounts you own. At your switch point, your chats move to another of them and keep going.

[Download](https://shuriken.sh/download)

[Other platforms](https://shuriken.sh/download#main)

## Keep reading

- [Codex with more than one ChatGPT account: Update 27 Oct 2026 4 min read Add each ChatGPT sign-in you own as a source. When one reaches its Codex limit, Shuriken moves your Codex chats to the next and they carry on.](https://shuriken.sh/blog/codex-multiple-chatgpt-accounts)
- [Codex usage limits explained (2026): Guide 27 Oct 2026 5 min read How Codex limits work on ChatGPT Plus and Pro: the 5-hour and weekly windows, the 2026 changes, checking yours with /status, and using several accounts.](https://shuriken.sh/guides/codex-usage-limits)
- [Can you use two ChatGPT accounts with Codex? The rules: Guide 27 Oct 2026 7 min read Multiple ChatGPT accounts for Codex are allowed: OpenAI's help center says you can create more. Sharing a login and circumventing rate limits are not.](https://shuriken.sh/guides/chatgpt-multiple-accounts-codex-rules)
- [Multiple accounts in every coding agent CLI: a reference: Guide 27 Oct 2026 9 min read Multiple accounts in a coding agent CLI: Copilot, Amp and OpenCode 2 switch natively. Most others need a home folder per account, set by one variable.](https://shuriken.sh/guides/coding-agent-multiple-accounts)
- [OpenCode with more than one account per provider: Guide 27 Oct 2026 6 min read OpenCode multiple accounts: auth.json keeps one login per provider, so a second sign-in replaces the first. A data folder per account keeps both.](https://shuriken.sh/guides/opencode-multiple-accounts)
- [Hot swapping: chats that move when an account runs out: Story 27 Oct 2026 4 min read Hot swapping AI accounts, the way Shuriken does it: your running chats move to another of your accounts when one nears its limit. What happens at 99%.](https://shuriken.sh/blog/hot-swapping-accounts)

## Free tools

- [Claude limit reset tracker](https://shuriken.sh/tools/limit-resets/claude)
- [Codex limit reset tracker](https://shuriken.sh/tools/limit-resets/codex)