Fix Codex CLI Login Failed

Match the symptom

• Browser sign-in completes but the terminal remains logged out.
• The CLI repeatedly asks you to authenticate.
• A remote or headless terminal cannot open or receive the browser callback.
• Codex is authenticated with a different method than expected.

First checks

Collect evidence before changing configuration

codex login status
codex doctor

codex logout
codex login

codex login --device-auth

Diagnosis 1

Separate installation from authentication

First prove that the executable runs, then inspect the active authentication mode and diagnostics.

codex --version
codex login status
codex doctor

Decision: If `codex --version` fails, fix installation or PATH first. If status reports logged in, the failure may be account access, network, or workspace policy rather than login storage.

Diagnosis 2

Remove stale credentials and sign in again

Use the CLI's logout command instead of manually deleting configuration files.

1. Complete the flow with the intended ChatGPT account.
2. Return to the same terminal after the browser reports success.
3. Do not start multiple simultaneous login attempts.

codex logout
codex login
codex login status

Decision: A successful status check confirms credentials were stored. Test a small, non-sensitive request next.

Diagnosis 3

Use device authentication when callbacks cannot return

The device flow is designed for environments where launching a local browser or receiving its callback is unreliable.

1. Open the displayed verification URL in a browser you control.
2. Enter the device code exactly once and wait for the original terminal to update.

codex login --device-auth

Decision: If device auth also fails, capture the diagnostic output and check proxy, firewall, account, or organization restrictions.

Diagnosis 4

Use API-key authentication only when intentional

API-key login is a separate mode. Pass secrets through standard input; never place a key directly in shell history or a committed config file.

printenv OPENAI_API_KEY | codex login --with-api-key
codex login status

Decision: If you intended ChatGPT OAuth, do not switch to an API key as a workaround; repair the OAuth flow instead.

If it still fails, send this evidence

A useful support request is reproducible and does not expose credentials.

• Output of `codex --version`, `codex login status`, and `codex doctor` with secrets removed.
• Whether the terminal is local, WSL, SSH, containerized, or behind a corporate proxy.
• The point where the flow fails: browser launch, authorization, callback, or the next API request.
• The exact error and timestamp; never include access tokens, API keys, or device codes.