[CLI][Windows] Login fails with token_exchange_failed although auth endpoints are reachable

[masahidenac]

What version of the Codex App are you using (From “About Codex” dialog)?

codex-cli 0.146.0

What subscription do you have?

ChatGPT Business

What platform is your computer?

Windows 11 Home 25H2 Build 26200 x64

What issue are you seeing?

Summary

Codex CLI cannot authenticate on one specific Windows PC.

The same ChatGPT Team account successfully logs into Codex on another Windows PC.

The issue is fully reproducible.

It occurs with both:

• codex login
• codex login --device-auth

---

Environment

• Windows 11 Home 25H2
• Build 26200
• x64
• Codex CLI 0.146.0
• Node.js 24.13.1
• npm 11.8.0

---

Browser login

Running:

codex login

opens the browser correctly.

After signing in, authentication fails with:

Sign-in could not be completed

Token exchange failed:
error sending request for url
https://auth.openai.com/oauth/token

Error code:
token_exchange_failed

Device authentication

Running:

codex login --device-auth

always returns:

Error logging in with device code:
error sending request for url
https://auth.openai.com/api/accounts/deviceauth/usercode
Diagnostics performed
Reinstalled Codex CLI
Deleted ~/.codex
Cleared npm cache
Installed latest CLI
No WinHTTP proxy configured
No HTTP_PROXY / HTTPS_PROXY configured
DNS resolution succeeds
TCP connection to auth.openai.com:443 succeeds
curl successfully connects to auth.openai.com
curl reaches the OAuth endpoints and receives valid HTTP responses
Browser authentication opens correctly
Claude Code works normally on the same PC
The same ChatGPT Business account works correctly on another Windows PC

### What steps can reproduce the bug?

## Steps to reproduce

1. On Windows 11 Home 25H2 (Build 26200), install Codex CLI 0.146.0.
2. Run:

```powershell
codex login --device-auth

3. Observe the following error:

Error logging in with device code:
error sending request for url
https://auth.openai.com/api/accounts/deviceauth/usercode

4. Run:

codex login

5. Complete browser sign-in.

6. After browser authentication, observe:

Sign-in could not be completed

Token exchange failed:
error sending request for url
https://auth.openai.com/oauth/token

Error code:
token_exchange_failed

Reproducibility

The issue occurs every time on this specific PC.

It may be environment-specific and may not reproduce on every Windows machine. The same ChatGPT Team account works correctly with Codex on another Windows 11 PC.

Additional notes

• auth.openai.com:443 is reachable.
• DNS resolution succeeds.
• curl can reach the authentication endpoints and receives valid HTTP responses.
• Claude Code works normally on the same PC.
• Reinstalling Codex CLI, clearing the npm cache, and deleting the .codex directory did not resolve the issue.
• No session ID, token usage, or context-window information is applicable because the failure occurs before a Codex session is created.

What is the expected behavior?

Expected behavior

Codex CLI should complete authentication successfully.

Additional information

Actual behavior

Authentication always fails during the token exchange stage.

This appears to be specific to Codex CLI on this Windows environment because browser authentication, curl, and another Windows PC all work correctly.

[masahidenac]

I can reproduce the same issue consistently and wanted to add another data point.

Environment

• Windows 11
• Codex v0.146.0
• Same OpenAI account on both machines

Behavior
The OpenAI provider consistently fails with:

stream disconnected before completion:
error sending request for url (https://chatgpt.com/backend-api/codex/responses)

What I tested

• Restarted the PC → no change.
• The issue occurs in both Codex Desktop and the VS Code extension on the affected machine.
• Using the same OpenAI account on another Windows laptop works normally.
• On the affected PC, switching to the Fugu provider (codex -p fugu) works correctly.

This seems to suggest that the Codex client itself is functioning, and the issue may be specific to the OpenAI provider, authentication/session handling, or the connection to the chatgpt.com/backend-api/codex/responses endpoint on this machine.

If there are any diagnostics, logs, or additional tests that would help identify the root cause, I'd be happy to provide them.

[masahidenac]

Additional test result:

On the affected PC, Codex works correctly when authenticated with an OpenAI API key. I can successfully access and select OpenAI models, including gpt-5.6-sol.

Current results on the same machine:

• ChatGPT sign-in / OAuth authentication: consistently fails with stream disconnected before completion
• OpenAI API key authentication: works normally
• Fugu provider: works normally
• The same ChatGPT account also works normally on another PC

This appears to narrow the issue down to the ChatGPT OAuth authentication/session path on this specific machine, rather than the Codex client, general network connectivity, or model streaming.

Please let me know if there are any OAuth/session diagnostics or logs I can provide.

[masahidenac]

Root cause identified: Norton 360 HTTPS/Web protection was interfering with TLS certificate validation on the affected PC. After temporarily disabling the relevant Norton web protection feature, Codex requests completed successfully.

The previous invalid peer certificate: BadSignature error appears to have been caused by HTTPS inspection rather than Codex authentication or the provider itself.