Hmbown/CodeWhale · error

Codex access token in {} is expired. Read-only consent never

Error message

Codex access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `codex login`, or provide OPENAI_CODEX_ACCESS_TOKEN for this process.

What it means

get_credentials found stored Codex credentials whose access token is past expiry. By design the integration only reads another CLI's auth file read-only — it never refreshes or rewrites those tokens — so the fix is external: re-login with codex or inject a fresh token via OPENAI_CODEX_ACCESS_TOKEN.

Source

Thrown at crates/tui/src/oauth.rs:167

#[must_use]
pub fn stored_credentials_present(grant: &ExternalCredentialReadGrant) -> bool {
    load_credentials(grant)
        .ok()
        .flatten()
        .is_some_and(|credentials| !token_is_expired(&credentials.access_token))
}

/// Load read-only credentials from the exact external path authorized by
/// `grant`. Expired tokens fail with guidance; they are never refreshed.
pub fn get_credentials(grant: &ExternalCredentialReadGrant) -> Result<CodexCredentials> {
    let creds = load_credentials(grant)?.with_context(missing_auth_message)?;

    // Check if the access token is still valid.
    if !token_is_expired(&creds.access_token) {
        return Ok(creds);
    }

    bail!(
        "Codex access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `codex login`, or provide OPENAI_CODEX_ACCESS_TOKEN for this process.",
        codewhale_config::quote_os_path(grant.path())
    )
}

#[must_use]
pub fn missing_auth_message() -> String {
    format!(
        "OpenAI Codex OAuth credentials are unavailable.\n\
         \n\
         Codewhale checks OPENAI_CODEX_ACCESS_TOKEN and CODEX_ACCESS_TOKEN automatically.\n\
         Access to the Codex CLI file is disabled by default. After `codex login`, grant read-only access explicitly with:\n\
         `codewhale auth external-consent --provider openai-codex --mode read-only --path {}`\n\
         Read-only access never refreshes or rewrites the Codex CLI file.",
        codewhale_config::quote_os_path(&auth_file_path())
    )
}

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Run codex login to refresh the external CLI's credentials
2. Or export OPENAI_CODEX_ACCESS_TOKEN with a valid token for this process

When it happens

Trigger: Thrown at crates/tui/src/oauth.rs:167 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/50c9b90eaddc720d. Report an issue: GitHub.