Codex Security cloud authentication refresh failed

Error message

Codex Security cloud authentication refresh failed

What it means

#request retries once on HTTP 401 (attempt 0) hoping the access token refreshes; if the second attempt also returns 401, the loop exits and this error is thrown. It means cloud authentication could not be established even after a forced refresh.

Source

Thrown at packages/coding-agent/src/security/cloud.ts:226

			const body = typeof options.body === "function" ? options.body(access.accessToken) : options.body;
			const headers: Record<string, string> = {
				Accept: "application/json",
				Authorization: `Bearer ${access.accessToken}`,
			};
			const accountId = access.accountId ?? this.#account.accountId;
			if (accountId) headers["ChatGPT-Account-Id"] = accountId;
			if (body) headers["Content-Type"] = "application/json";
			const response = await this.#fetch(url, {
				method: options.method ?? "GET",
				headers,
				body: body ? JSON.stringify(body) : undefined,
				signal: options.signal,
			});
			if (response.status === 401 && attempt === 0) continue;
			if (!response.ok) throw new CodexSecurityCloudHttpError(response.status, url.pathname);
			return object(await response.json());
		}
		throw new Error("Codex Security cloud authentication refresh failed");
	}

	async listConfigurations(
		options: { limit?: number; cursor?: string; signal?: AbortSignal } = {},
	): Promise<CodexSecurityCloudConfigurationPage> {
		const raw = await this.#request("scan_configurations", {
			query: { limit: options.limit ?? 100, cursor: options.cursor },
			signal: options.signal,
		});
		const items = Array.isArray(raw.items) ? raw.items.map(normalizeConfiguration) : [];
		const result: CodexSecurityCloudConfigurationPage = { items };
		const nextCursor = optionalString(raw.next_cursor);
		if (nextCursor) result.nextCursor = nextCursor;
		if (typeof raw.total_in_account === "number") result.totalInAccount = raw.total_in_account;
		return result;
	}
	async listAllConfigurations(signal?: AbortSignal): Promise<CodexSecurityCloudConfiguration[]> {
		const configurations: CodexSecurityCloudConfiguration[] = [];

View on GitHub (pinned to 9690622007)

Solutions

Re-authenticate the openai-codex credential (fresh login) and retry
Delete and re-add the stored OAuth credential
Check provider status / cloud incidents if refresh succeeds but API still 401s
Verify system clock correctness (skew breaks token validation)

Example fix

// before
await client.listConfigurations(); // throws after double 401
// after
try {
  await client.listConfigurations();
} catch {
  await reauthenticateChatGPT(authStorage); // fresh tokens
  await client.listConfigurations();
}

Defensive patterns

Strategy: retry

Validate before calling

const accounts = authStorage.listOAuthAccounts("openai-codex");
if (accounts.length === 0) throw new Error("No openai-codex credential; authenticate first");

Try / catch

try {
  return await client.listFindingDetails(id);
} catch (err) {
  if (err.message === "Codex Security cloud authentication refresh failed") {
    await reauthenticate("openai-codex"); // one re-auth, then single retry
    return await client.listFindingDetails(id);
  }
  throw err;
}

Prevention

Refresh credentials proactively before scans
Surface re-auth prompts instead of failing silently
Check ChatGPT session status when repeated 401s occur

When it happens

Trigger: Two consecutive 401 responses from the Codex Security cloud API: expired/revoked refresh token, revoked ChatGPT session, or a server-side auth rejection that survives token refresh.

Common situations: ChatGPT session revoked (password change, device sign-out); long-lived credential whose refresh token expired; cloud-side auth backend incident.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/bdd48d0f501147e1. Report an issue: GitHub.