Codex "unexpected status 401 Unauthorized": how to fix it

Fix it

1. Read the end of the error. Note the url: part, and any key the message names. These are your best clues to the cause.
2. Find your case in the table below.
3. If it isn't an OpenAI outage, sign in again:
   • If you use a ChatGPT account: run codex logout, then codex login.
   • If you use an API key: copy a working key from your OpenAI API keys page. Run codex logout, then start codex and choose the option to sign in with an OpenAI API key, and paste the key there. (codex login --with-api-key only reads a key piped into it, and piping in an OPENAI_API_KEY that still holds the old, bad key would save it again.)
   • On a remote or headless computer: first turn on device code sign-in in your ChatGPT security settings (on a workspace account, an admin turns it on), then run codex login --device-auth on that computer.
4. Make sure nothing keeps the old sign-in. Fully quit Codex, including the desktop app. If you use the command-line tool, also restart its background server: type /daemon in Codex and choose Restart background server.
5. Check it worked: send Codex a short prompt. codex login status shows how you're signed in, but it doesn't test the key. In our test it said "Authentication is checked when you send a request."

Status:

• How this page was made: it is Sourced. Most fixes come from OpenAI's docs, its status page and comments from the Codex team. The fixes in rows 4 and 5 of the table rely on user reports.
• What Kingy reproduced: two of the messages, Missing bearer or basic authentication in header and Incorrect API key provided. We used no key, then a deliberately fake one, on Codex CLI 0.167.0 (the npm latest release on November 6, 2026) and 0.166.0-alpha.6, on macOS.
• What Kingy couldn't test: any of the fixes, because that needs a real account or key.

Which 401 do you have?

Where these come from:

• First row: the cause, timing and workaround are from OpenAI's status page and write-up. The message text is from many user reports in the outage thread.
• Second and third rows: the messages are from Kingy's test. The fixes are from OpenAI's docs and weren't tested.
• Fourth row: user reports from several people on different versions.
• Fifth and sixth rows: single reports, plus the wording of the error itself.

OPENAI_API_KEY doesn't sign you in to Codex

Older Codex versions read your OPENAI_API_KEY setting, and even an older OpenAI example used it. The Codex team has since called that out of date.

In current Codex, normal model requests don't read it. In our test, on both versions:

• codex exec with only OPENAI_API_KEY set still said Missing bearer or basic authentication in header.
• With CODEX_API_KEY set instead, it used that key.

What the Codex team and code say:

• The Codex team said in March 2026 that the sign-in screen uses OPENAI_API_KEY to pre-fill the key. In November 2025 they told a user that codex exec reads CODEX_API_KEY, not OPENAI_API_KEY.
• Current Codex code also falls back to OPENAI_API_KEY for a few side features, such as voice (realtime_conversation.rs at commit ddd1812a51).

To use an API key, either:

• save it: start codex, choose to sign in with an OpenAI API key and paste it, or pipe it into codex login --with-api-key as OpenAI's docs show, or
• pass it for one run: OpenAI's docs say CODEX_API_KEY works with codex exec, codex review, the TypeScript SDK and codex exec-server --remote.

A few users blamed an OPENAI_API_KEY in their shell for a 401, and at least two say removing it fixed it. OpenAI hasn't explained why, and only one of them named a version.

Signed in again, but still getting 401?

Codex's command-line tool can run a shared background server that holds your sign-in.

• What the Codex team said: in October 2026, a team member said this server only picks up a hand-edited auth.json after it restarts.
• What users report: closing the terminal window doesn't restart it, and one user says a codex login run from another window wasn't picked up until the server restarted.

Fix: in Codex, type /daemon and choose Restart background server. That's OpenAI's documented control for it. Better still, sign out and in from inside Codex instead of editing files.

The September 25, 2026 outage

On September 25, 2026, from about 22:33 to 23:47 UTC, Codex users signed in with ChatGPT got 401 errors, and some 502 errors.

• The cause: OpenAI's write-up says its leak-detection system wrongly flagged credentials that its own internal services use, and they were then revoked.
• What users could do: Codex access through API keys wasn't affected, and OpenAI's status page suggested signing in with an API key as a workaround.
• How it ended: OpenAI restored the credentials the same day.
• What users saw: the message named a service-account key (sk-svc…) that wasn't theirs. They reported that signing out and in, a clean CODEX_HOME folder and older versions didn't help while it lasted.

If you see that same kind of key today, check the status page first.

Before the 401: "Reconnecting..."

In our test, Codex printed Reconnecting... lines up to 5/5. The 401 first appeared in the line where it switched from WebSockets to HTTPS. Codex then retried over HTTPS and printed the 401 again as its final ERROR: unexpected status 401 line. With a key saved, 401 lines from a background model-list check appeared before all of that. The reconnect lines aren't the problem in themselves. Read the final 401 line.

How Kingy tested this

• Setup: Codex CLI 0.167.0 and 0.166.0-alpha.6, run in throwaway folders (their own CODEX_HOME and home folder) on macOS.
• The key: first no key at all. Then a deliberately fake key, saved with codex login --with-api-key or passed through OPENAI_API_KEY or CODEX_API_KEY. No real account or key was used.
• Same results on both versions.
• Evidence: the script and full raw logs are kept with this page's evidence. Key text, network IDs and request IDs are masked.

Sources

• Kingy lab logs, 2026-11-06 (UTC): Codex CLI 0.167.0 and 0.166.0-alpha.6, macOS 26.3.

OpenAI:

• Issues with Codex, incident write-up and the incident page: the September 25 cause, the timing, the 401 and 502 errors, API keys unaffected, the workaround. Read 2026-11-06.
• Codex authentication docs: sign-in methods, codex login --with-api-key, --device-auth (beta; turn it on in ChatGPT security settings), codex login status. Read 2026-11-06.
• Non-interactive mode: where CODEX_API_KEY works. Read 2026-11-06.
• Slash commands: manage the background server with /daemon. Read 2026-11-06.

Codex team on GitHub:

• #15151: OPENAI_API_KEY pre-fills sign-in (March 2026).
• #7323: codex exec reads CODEX_API_KEY, not OPENAI_API_KEY (November 2025).
• #49651: the background server keeps old credentials until it restarts.
• #48237: the September 25 outage thread.
• #2341: the command-line tool no longer signs in from the environment variable on its own.

Codex source:

• manager.rs at commit ddd1812a51: which credentials Codex reads for model requests. Read 2026-11-06.

User reports (read 2026-11-06):

• #41973, #13838 and #39883: {"detail":"Unauthorized"} and what did or didn't fix it. Quitting every Codex process is in this #41973 comment.
• #48368: a sign-in from another window not picked up until the server restarted.
• #47456: the workspace routing 401 on a remote computer.
• #15151: the missing-scopes message, and users who removed OPENAI_API_KEY.