termdeck
The refresh token rotates on every use
A successful refresh returns a new refresh token and retires the one you sent. Anything still holding the old value is holding something that can never be used again.
Codex CLI fix: Codex keeps asking you to sign in again
Codex CLI keeps asking you to sign in
The refresh token rotates every time it is used, and presenting one that has already been spent revokes the login outright. That makes a second copy of auth.json a way to lose the first one.
refresh token was revoked. Please log out and sign in again.
Printed by Codex CLI.
Diagnosis
What it actually is
Reuse is detected, and it is punished
Presenting an already-spent refresh token does not fail quietly, it revokes the login. Measured the hard way while building account switching: refreshing twice and then replaying the original killed the session outright.
A second reader is all it takes
Two processes against one auth.json is the usual shape. A credential file copied to another machine, a restored backup, or a second long-lived helper refreshing beside the CLI. None of them is doing anything wrong on its own.
Check
Confirm it before you fix it
| Run this | What a good answer looks like |
|---|---|
codex login status | Whether this machine still believes it is signed in. A revoked login often looks fine locally until the next refresh is attempted. |
ls -l ~/.codex/auth.json | The modification time is when the credential last rotated. Two machines whose copies both keep changing is the shared-file case, visible without reading either file. |
Every command here has been run on a real machine. Termdeck answers the same questions for every machine you have connected, without opening a terminal on any of them.
Fix
Cheapest thing first
1. Log out and sign in again, on one machine
The revocation is final for that token. A fresh sign-in mints a new pair, which is exactly what the message asks for.
2. Stop the second reader first
Otherwise the new token is spent by whichever process reaches it first and the loop resumes within the hour. Sign in on one machine and let the other sign in for itself.
3. Give each machine its own login
Two machines can use the same account. What they cannot share is one credential file.
Not this
What will not help
Copying auth.json between machines
This is the thing that causes it. Two machines sharing one credential file will keep revoking each other, and each revocation looks like a fresh problem.
Restoring auth.json from a backup
A restored file is by definition an old token, so restoring one is the same as replaying it, with the same result.
FAQ
Codex keeps asking you to sign in again, answered
Why does this keep happening on one machine?
Something else is refreshing the same credential: a second process, a sync tool copying the file, or a restored backup. All three look identical from the server side.
Does signing in again fix it permanently?
It fixes it until the same second reader spends the new token. Remove the cause first, then sign in.
Is this an outage?
No. Reuse detection is deliberate, and it is what stops a leaked token being used behind you.
Claude Code, Codex and Grok in one browser console