HKUDS/Vibe-Trading · critical · CodexAuthenticationError

The Codex backend rejected the access token and refresh did

Error message

The Codex backend rejected the access token and refresh did not replace it

What it means

After a forced refresh, the server returned the exact same access token that was just rejected, meaning the token is dead and refresh cannot rotate it. The library clears storage and raises CodexAuthenticationError; user re-login is required.

Source

Thrown at agent/src/providers/openai_codex.py:381

            return token

        try:
            refreshed = _refresh_codex_token(token, storage)
        except _CodexRefreshError as exc:
            if exc.permanent:
                _clear_codex_token(storage)
                raise CodexAuthenticationError("The Vibe-Trading Codex OAuth session was invalidated") from exc
            if not force_refresh and _token_expiry_ms(token) > now_ms:
                return token
            raise CodexStreamError(
                exc.status_code or 503,
                f"Codex OAuth recovery temporarily failed: {exc}",
            ) from exc
        if refreshed.access == token.access:
            if not force_refresh and _token_expiry_ms(token) > now_ms:
                return token
            _clear_codex_token(storage)
            raise CodexAuthenticationError("The Codex backend rejected the access token and refresh did not replace it")
        return refreshed


def validate_codex_base_url(url: str) -> str:
    """Validate the only supported ChatGPT Codex OAuth endpoint.

    ChatGPT OAuth tokens must not be sent to arbitrary OpenAI-compatible base
    URLs. The standard OpenAI API remains API-key authenticated; this provider
    is limited to the ChatGPT Codex backend endpoint used by Codex OAuth.
    """
    value = (url or DEFAULT_CODEX_URL).strip().rstrip("/")
    parsed = urlparse(value)
    if parsed.scheme != "https" or parsed.netloc != "chatgpt.com" or parsed.path != "/backend-api/codex/responses":
        raise ValueError("OpenAI Codex OAuth only supports https://chatgpt.com/backend-api/codex/responses")
    return value


def _build_headers(account_id: str, access_token: str) -> dict[str, str]:

View on GitHub (pinned to 80ffdda44c)

Solutions

Run interactive Codex login again to obtain a brand-new OAuth session
Delete the stored token file under runtime auth dir if login still sees stale state, then log in
Check that only one process performs refreshes (file locking) to avoid session corruption

Example fix

# before
CodexAuthenticationError: The Codex backend rejected the access token and refresh did not replace it

# after
vibe-trading provider login openai-codex  # fresh interactive login

Defensive patterns

Strategy: try-catch

Validate before calling

status = get_openai_codex_login_status()
if not status.token_present:
    raise SystemExit('login required')

Try / catch

try:
    resp = stream_request()
except CodexAuthenticationError:
    login_openai_codex()  # interactive re-login
    resp = stream_request()

Prevention

Automate a re-login path when CodexAuthenticationError is caught
Keep a single owning process for token refresh to avoid corruption

When it happens

Trigger: Backend rejected the access token (401), forced refresh succeeded but refreshed.access == token.access, i.e. the endpoint did not issue a new token — a stuck/invalidated session.

Common situations: Server-side session invalidation where refresh silently echoes the old token; clock skew or corrupted token files causing rejected-but-returned tokens.

Related errors

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/76235324c5570391. Report an issue: GitHub.