[codex] Revoke ChatGPT tokens on logout by sashank-oai · Pull Request #17825 · openai/codex

sashank-oai · 2026-04-14T19:17:15Z

Summary

This changes Codex logout so managed ChatGPT auth is revoked against AuthAPI before local auth state is removed. CLI logout, TUI /logout, and the app-server account logout path now use the token-revoking logout flow instead of only deleting auth.json / credential store state.

Root Cause

Logout previously cleared only local auth storage. That removed Codex's local credentials but did not ask the backend to invalidate the refresh/access token state associated with a managed ChatGPT login.

Behavior

For managed ChatGPT auth, logout sends the stored refresh token to https://auth.openai.com/oauth/revoke with token_type_hint: refresh_token and the Codex OAuth client id, then deletes all local auth stores after revocation succeeds. If only an access token is available, it falls back to revoking that access token. API key auth and externally supplied chatgptAuthTokens are still only cleared locally because Codex does not own a refresh token for those modes.

Revocation failures are fail-closed: if Codex cannot load stored auth or the backend revoke call fails, logout returns an error and leaves local auth in place so the user can retry instead of silently clearing local state while backend tokens remain valid.

Validation

ran local version of codex-cli with staging overrides/harness for auth

ran codex login then codex logout:

saw auth.json clear and backend revocation endpoints were called

POST /oauth/revoke
status: 200

revoking access token
should clear auth session
clearing auth session due to token revocation
successfully revoked session and access token
CANONICAL-API-LINE Response: status='200' method='POST' path='/oauth/revoke

github-actions · 2026-04-14T19:17:31Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/tui/src/chatwidget/slash_dispatch.rs

Lines 235 to 238 in fc7bb69

    
           if let Err(e) = codex_login::logout( 
        
               &self.config.codex_home, 
        
               self.config.cli_auth_credentials_store_mode, 
        
           ) {

Route TUI /logout through token-revoking logout

The TUI logout command still calls codex_login::logout, which only clears local storage. Users logging out via /logout won't hit the new revoke flow, so managed ChatGPT refresh tokens remain valid server-side. This leaves logout behavior inconsistent across surfaces and bypasses the security intent of this change.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9882aa844b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

sashank-oai · 2026-04-15T18:07:01Z

I have read the CLA Document and I hereby sign the CLA

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7520b3625c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Co-authored-by: Codex <noreply@openai.com>

Continue deleting local auth state even when the OAuth revoke request fails. Co-authored-by: Codex <noreply@openai.com>

Increase the command timeout for request-permissions shell events so CI does not time out while waiting for approval and sandbox setup. Co-authored-by: Codex <noreply@openai.com>

etraut-openai · 2026-04-17T01:30:10Z

+                let codex_home = self.config.codex_home.clone();
+                let auth_credentials_store_mode = self.config.cli_auth_credentials_store_mode;
+                let app_event_tx = self.app_event_tx.clone();
+                tokio::spawn(async move {


We should change this to call the app server API for logging out rather than calling the local version. Otherwise this won't work for scenarios where the TUI is connected to a remote host.

This was an existing bug (that I wasn't aware of). Now that we know about it, we should probably fix it here. If you decide not to fix it in this PR, let me know and I can do a follow-up fix.

etraut-openai · 2026-04-17T01:31:16Z

@@ -0,0 +1,203 @@
+use serde::Serialize;


Nit: Add header comment explaining what this module does.

etraut-openai · 2026-04-17T01:35:54Z

+    codex_home: &Path,
+    auth_credentials_store_mode: AuthCredentialsStoreMode,
+) -> std::io::Result<bool> {
+    let storage = create_auth_storage(codex_home.to_path_buf(), auth_credentials_store_mode);


Why are we reloading the auth information from disk here rather than using the AuthManager? It is meant to be the source of truth for the current auth and any tokens associated with it. By going around the AuthManager's back and loading the auth information directly from disk, you're breaking the internal contract.

etraut-openai

Looks good!

sashank-oai marked this pull request as ready for review April 14, 2026 19:34

chatgpt-codex-connector Bot reviewed Apr 14, 2026

View reviewed changes

cooper-oai reviewed Apr 14, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/revoke.rs Outdated

cooper-oai reviewed Apr 14, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/revoke.rs Outdated

cooper-oai reviewed Apr 14, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/manager.rs Outdated

chatgpt-codex-connector Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/manager.rs Outdated

github-actions Bot added a commit that referenced this pull request Apr 15, 2026

@sashank-oai has signed the CLA in #17825

88b4ab8

sashank-oai force-pushed the codex/revoke-tokens-on-logout branch from 0beb9dd to c789eb3 Compare April 15, 2026 18:17

chatgpt-codex-connector Bot reviewed Apr 15, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/revoke.rs

sashank-oai requested a review from cooper-oai April 15, 2026 21:44

sashank-oai and others added 6 commits April 16, 2026 13:52

Revoke ChatGPT tokens on logout

a9380dc

Co-authored-by: Codex <noreply@openai.com>

Address logout revoke review feedback

85d20f7

Co-authored-by: Codex <noreply@openai.com>

Make logout revoke best effort

1f5745d

Continue deleting local auth state even when the OAuth revoke request fails. Co-authored-by: Codex <noreply@openai.com>

Deflake request permissions test timeout

a7c4939

Increase the command timeout for request-permissions shell events so CI does not time out while waiting for approval and sandbox setup. Co-authored-by: Codex <noreply@openai.com>

Limit logout revoke PR scope

fc1c7ce

Bound logout revoke request duration

be4de2f

sashank-oai force-pushed the codex/revoke-tokens-on-logout branch from d02611f to be4de2f Compare April 16, 2026 20:55

etraut-openai requested changes Apr 17, 2026

View reviewed changes

Address logout revoke review feedback

f0d5099

sashank-oai requested a review from etraut-openai April 17, 2026 02:11

etraut-openai approved these changes Apr 17, 2026

View reviewed changes

sashank-oai merged commit 22f7ef1 into main Apr 17, 2026
35 of 36 checks passed

sashank-oai deleted the codex/revoke-tokens-on-logout branch April 17, 2026 05:51

github-actions Bot locked and limited conversation to collaborators Apr 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[codex] Revoke ChatGPT tokens on logout#17825

[codex] Revoke ChatGPT tokens on logout#17825
sashank-oai merged 7 commits intomainfrom
codex/revoke-tokens-on-logout

sashank-oai commented Apr 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

sashank-oai commented Apr 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

etraut-openai Apr 17, 2026

Uh oh!

etraut-openai Apr 17, 2026

Uh oh!

etraut-openai Apr 17, 2026

Uh oh!

etraut-openai left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	if let Err(e) = codex_login::logout(
	&self.config.codex_home,
	self.config.cli_auth_credentials_store_mode,
	) {

Conversation

sashank-oai commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause

Behavior

Validation

Uh oh!

github-actions Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

sashank-oai commented Apr 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

etraut-openai Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

etraut-openai Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

etraut-openai Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

etraut-openai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sashank-oai commented Apr 14, 2026 •

edited

Loading

github-actions Bot commented Apr 14, 2026 •

edited

Loading