[Windows] Sign in with ChatGPT still generates & requires an API key (Pro user) → API charges; revoking key breaks CLI

[4erdenko]

Summary
As a ChatGPT Pro user, I expected Codex CLI to work under my Pro plan without consuming API credits. However, the “Sign in with ChatGPT” flow auto‑creates an API key for my selected API org/project. If I revoke that key to avoid API charges, the CLI fails with 401 Incorrect API key provided and then forces me to sign in again, which creates a new API key. In short, there seems to be no way to use Codex CLI without an API key being generated and billed to the API account.

Environment

• Codex CLI: 0.19.0 (output of codex --version)
• Install method: npm i -g @openai/codex
• OS: Windows 11 (running in Git Bash / MINGW64; not using WSL for this repro)
• Organization: Personal → Default project
• Config directory: ~/.codex/ (an auth.json file appears after login)

Steps to Reproduce

1. Ensure no OPENAI_API_KEY is set in the environment and remove any previous Codex state:

   • Delete ~/.codex/ (or at least ~/.codex/auth.json).

2. Run codex and select “Sign in with ChatGPT”.

3. In the browser, select my API Organization and Default project, then click Continue.

4. Observe that an API key named “Codex CLI (auto‑generated)” is created in the API dashboard, and ~/.codex/auth.json now holds credentials (including an sk-proj-... key).

5. Revoke that auto‑generated key in the API dashboard.

6. Run codex again.

Actual behavior

• The CLI shows:

  system  ⚠️ OpenAI rejected the request ...
  Error details: Status: 401, Code: invalid_api_key, Message: 401 Incorrect API key provided: sk-proj-***********...
  

• The CLI asks me to log in again; completing login creates a new API key. I cannot run Codex CLI without having an active API key, which leads to API charges.

Expected behavior

• As a Pro user using “Sign in with ChatGPT”, I expected a mode that does not create or require an API key and does not consume API credits, or at least a clear toggle (“use ChatGPT plan entitlements only”).
• If I “Disconnect” Codex CLI in ChatGPT settings or revoke the key, Codex CLI should not silently recreate a billable key.

What I tried (no change)

• Deleted ~/.codex/ and re‑logged in.
• Ensured OPENAI_API_KEY is unset.
• Revoked the “Codex CLI (auto‑generated)” key multiple times — CLI always re‑creates a new key after login.

Logs
From the CLI run after revoking the key (redacted):

system  ⚠️ OpenAI rejected the request (request ID: req_19a4b978fff39e57e93e03f92d4c027a).
Error details: Status: 401, Code: invalid_api_key, Type: invalid_request_error,
Message: 401 Incorrect API key provided: sk-proj-***eZoA.

I can also provide ~/.codex/log/codex-tui.log with RUST_LOG=codex_core=debug,codex_tui=debug if needed.

Why I believe this is a bug/UX gap

• The official “Sign in with ChatGPT” docs say the flow creates a key automatically and that Disconnect only removes the OAuth grant, not the key itself. This appears to leave no path to run Codex CLI under a Pro plan without a billable API key.
• The README also instructs users migrating from API key billing to ensure OPENAI_API_KEY is unset and re‑login; however, re‑login still auto‑creates a key, so billing remains tied to API.

Request

• Provide a “Pro/Plus entitlement” mode that does not rely on an API key (or at least a setting to not auto‑create one).
• Alternatively, clearly document that Codex CLI currently requires an API key and will bill the API account (even for Pro users), and outline how/when this will change.
• If a non‑API billing mode is planned, please share timelines or a beta flag we can test.

[M1kEk1M]

I believe that we are shipped with older version of CLI for windows.
Tried to build codex-rs for windows, got error about "Keyboard progressive enhancement not implemented for the legacy Windows API." which is from crossterm.

Managed to build with commented lines (just to check my assumption)

execute!(
        stdout(),
        PushKeyboardEnhancementFlags(
            KeyboardEnhancementFlags::DISAMBIGUATE_ESCAPE_CODES
                | KeyboardEnhancementFlags::REPORT_EVENT_TYPES
                | KeyboardEnhancementFlags::REPORT_ALTERNATE_KEYS
        )
    )?;

In codex-rs\tui\src\tui.rs

And it worked - managed to make some requests to GPT. But the problem is that I can't pass login stage with this built version, so only worked for me because I logged in with my npm-shipped version and then launched this built one.

[osichin]

same issue as: #1953

[pakrym-oai]

I apologize for the inconvenience, login with ChatGPT is not fully working on Windows, we're working hard on fixing it.

[jacobhallgren]

Same problem here

[bolinfest]

Very hot off the presses, but 0.20.0 in npm https://www.npmjs.com/package/@openai/codex has some key fixes for Windows:

• Fix rust build on windows #2019
• feat: include windows binaries in GitHub releases #2035
• Use certifi certificate when available #2042

[optimikelabs]

Same problem on a pro account

[osichin]

@bolinfest - thank you! confirm it works now.

[bolinfest]

@mickahouan for good measure, can you delete %USERPROFILE%\.codex\auth.json and try again to make sure you're doing a clean auth flow on 0.20.0?