# \[Bug\]: Created Codex provider profiles continuously lose authentication every few minutes \(Could not check Codex right now\) · Issue \#23853 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/issues/23853)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: backlog

Priority: 0

## Description

[Discussion and activity](https://git.cafe/pingdotgg/t3code/issues/23853)

---

### Before submitting

- [x] I searched existing issues and did not find a duplicate.
- [x] I included enough detail to reproduce or investigate the problem.

### Area

Provider / Codex

### Steps to reproduce

1. Add one or more secondary/custom Codex provider instances (e.g. `codex2`, `codex3`) alongside the main Codex instance.
2. Complete authentication for the secondary instance via ChatGPT OAuth in provider settings until it is marked as `authenticated` and ready.
3. Wait several minutes (or perform tasks/delegated requests with the profile).
4. Observe that after a few minutes, a toast notification appears:
   > **ChatGPT - <instanceId> provider status**
   > *Could not check Codex right now. Retry, or reconnect in provider settings.*
   > `[Open provider setup]`
5. Clicking Retry or allowing automatic retries fails repeatedly (retries ~5 times and fails to reconnect).
6. Opening provider setup requires signing in through the browser multiple times to re-establish the connection.
7. Once successfully re-authenticated, the exact same scenario repeats after a few minutes.

### Expected behavior

- Secondary/created Codex profiles should maintain their session via automatic background token refresh without dropping authentication every few minutes.
- If a transient network glitch or token refresh timeout occurs during the periodic health snapshot check (`applySnapshot` / `refreshSnapshot`), it should gracefully retry with exponential backoff rather than immediately marking the provider as unavailable or purging credentials.
- Behavior should match the primary Codex instance, which reconnects smoothly without forcing the user into repeated manual browser re-authentication loops.

### Actual behavior

- The primary/main Codex profile (connected directly via local daemon / `~/.codex`) recovers automatically even if it blips.
- However, created Codex profiles (which run with isolated `shadowHomePath` and independent secret storage `codex-chatgpt:<instanceId>`) fail their token renewal during background health polling.
- The UI triggers:
  `Could not check Codex right now. Retry, or reconnect in provider settings.`
- Retrying fails up to 5 times. The user must manually re-authenticate via browser OAuth repeatedly, only for the session to invalidate again minutes later.

### Impact

Critical: Blocks sustained use of secondary Codex accounts or multi-profile load balancing, as accounts get disconnected every few minutes.

### Version or commit

- **App Version:** `0.1.1-nightly.20261017.3238`

### Environment

- **OS:** Windows 11 (NT 10.0.26200)

### Logs or stack traces

Captured from `server.trace.ndjson`:

```json
{
  "type": "effect-span",
  "name": "POST",
  "attributes": {
    "http.request.method": "POST",
    "url.full": "https://auth.openai.com/api/accounts/oauth/token",
    "server.address": "auth.openai.com",
    "server.port": 443
  },
  "exit": {
    "_tag": "Failure",
    "cause": "HttpClientError: Transport error (POST https://auth.openai.com/api/accounts/oauth/token)\n    at catch (binCli-DslDRLSw.mjs:45511:21)\n    at Effect-CJk1pQBd.mjs:9449:38\n    at POST\n    at CodexChatGptAuth.exchange (binCli-DslDRLSw.mjs:229968:25)\n    at CodexChatGptAuth.exchange (definition) (binCli-DslDRLSw.mjs:229744:19)\n    at applySnapshot (binCli-DslDRLSw.mjs:174757:83)\n    at refreshSnapshot (binCli-DslDRLSw.mjs:174790:459)\n    at makeManagedServerProvider (binCli-DslDRLSw.mjs:230330:26)\n    at makeManagedCodexProvider (binCli-DslDRLSw.mjs:230614:53) {\n  [cause]: TypeError: fetch failed {\n    [cause]: ConnectTimeoutError: Connect Timeout Error (attempted addresses: 104.18.41.241:443, 172.64.146.15:443, timeout: 10000ms)\n        at onConnectTimeout (node:internal/deps/undici/undici:1991:23)\n        at Immediate._onImmediate (node:internal/deps/undici/undici:1957:35)\n  }\n}"
  }
}
```

Followed by:

```
ProviderSetupError: ChatGPT sign-in is temporarily unavailable. Try again.
    at failure (binCli-DslDRLSw.mjs:229618:41)
    at CodexChatGptAuth.exchange
    at applySnapshot / refreshSnapshot
```

And in `makeManagedCodexProvider`, the status catch block reports:
```javascript
message: "Could not check Codex right now. Retry, or reconnect in provider settings."
```

### Screenshots, recordings, or supporting files

- Error notification banner:
  `ChatGPT - codex3 provider status`
  `Could not check Codex right now. Retry, or reconnect in provider settings.`
  `[Open provider setup]`

### Additional Context / Root Cause Clues

1. **Periodic Refresh Loop**: Background health checks (`DEFAULT_PROVIDER_HEALTH_REFRESH_INTERVAL`) periodically trigger `refreshSnapshot()` -> `runtime.auth.controller.withAccess(runtime.resolve)` -> `auth.access`.
2. **Aggressive Token Invalidation / Short Expiry**: `CodexChatGptAuth.access` checks `record.expiresAt - now > 6e4`. When within 60s, it calls `exchange` with `grant_type: "refresh_token"`.
3. **Transient Network or Re-use Failure**: If the refresh call times out (10s connect timeout) or receives OAuth errors like `invalid_grant` / `refresh_token_expired`, `exchange` executes `yield* remove;`, wiping stored tokens and forcing full browser re-authentication.