Fix Codex 401 Incorrect API Key Errors on Windows
If Codex stops with unexpected status 401 Unauthorized: Incorrect API key provided, the server has rejected the credential attached to the request. OpenAI's error guidance says this can happen when a key is wrong, belongs to another project or organisation, has been deleted or deactivated, or an old revoked key is cached locally.
In the Windows Codex app, a stale local sign-in or state database can keep sending the same rejected credential. The practical fix is to stop Codex completely, remove the cached authentication file and its local SQLite state, reopen the app, and sign in again.
Do not publish the key shown in the error. Keep it masked, as in sk-svcac…fvMA. If an unmasked key has been copied into a ticket, chat, screenshot or repository, revoke or rotate it.
What each part of the 401 message tells you
The useful details identify the failure and help support trace the request; they are not all separate problems.
401 Unauthorized
The request reached the service, but the supplied authentication credential was not accepted. This is different from a rate-limit or temporary server error.
Incorrect API key provided
The credential is invalid for the request. A stale, revoked, mismatched or incorrectly selected credential can produce this response.
backend-api/codex/responses
This is the service route that rejected the Codex request. It helps identify where the failure occurred; it is not a URL you need to open manually.
cf-ray and request ID
These are diagnostic identifiers. Save them with the timestamp if the problem continues and you need to contact support.
Step 1: stop Codex and end its remaining processes
Save any work you need, then fully quit the ChatGPT/Codex desktop app. Do not leave it minimised to the notification area. Open Windows Task Manager and end any remaining ChatGPT or Codex processes before deleting the files.
This matters because the SQLite database can remain open while the app is running. Its -wal and -shm companion files are part of SQLite's active write-ahead logging state. Stopping the processes first avoids file-lock errors and prevents the app from immediately recreating the files while you are clearing them.
Be aware: this reset may remove locally cached Codex task or session state. It does not delete your project files or Git history, but you should commit or back up important workspace changes before troubleshooting.
Step 2: clear the cached Codex authentication and local state
Open a fresh PowerShell window after Codex has stopped, then run:
Remove-Item "$env:USERPROFILE\.codex\auth.json" -Force -ErrorAction SilentlyContinue
Remove-Item "$env:USERPROFILE\.codex\state_5.sqlite*" -Force -ErrorAction SilentlyContinueThe first command removes the stored authentication file. The second uses a wildcard so it removes the main database and its SQLite companion files:
auth.jsonstate_5.sqlitestate_5.sqlite-walstate_5.sqlite-shm
-Force allows PowerShell to remove hidden or read-only matching files. -ErrorAction SilentlyContinue means the command will not fail noisily if a file is already absent.
Delete only these named files. Do not remove the entire %USERPROFILE%\.codex directory, because it can also contain configuration, skills and other local Codex data you may want to keep.
Step 3: restart Codex and authenticate again
- Reopen the ChatGPT/Codex desktop app.
- Complete the sign-in prompt with the intended ChatGPT account and workspace.
- Open a new Codex task and send a small test request.
- If you also use the Codex CLI, run
codex login statusto check the active authentication state.
The Windows app uses %USERPROFILE%\.codex as its Codex home directory. Removing auth.json forces a fresh local authentication state, while removing the state_5.sqlite* files lets the app rebuild its local database instead of reusing the previous cached state.
OpenAI's App Server documentation distinguishes a reauthentication condition from a normal request failure: stored OAuth credentials can expire and fail to refresh, at which point the client should reconnect. The reset above is a stronger local recovery step for cases where restarting and signing in normally have not cleared the bad credential.
If the 401 error still appears
- Check the account and workspace. Confirm you signed back into the account and workspace that has Codex access.
- Check explicit environment credentials. If you intentionally configured
OPENAI_API_KEY,CODEX_API_KEYor another managed authentication method, confirm it is current and belongs to the correct project or organisation. Do not paste its value into a public command or support message. - Update the app or CLI. The desktop app and Codex CLI can contain different Codex versions, so update the surface that is failing and retry.
- Separate 401 from other failures. A 401 is an authentication response. Network failures, 429 rate limits and 5xx server errors need different fixes.
- Keep diagnostics. Record the exact timestamp and timezone, app or CLI version, masked error, endpoint,
cf-rayand request ID for support.
If the problem began immediately after a key was rotated, a workspace changed, or an account was removed from a project, fix that access issue before repeating the local reset. Clearing files cannot make an inactive credential valid.
Sources Checked
- OpenAI API: Error codes
- OpenAI Docs: ChatGPT desktop app for Windows
- OpenAI Docs: Codex App Server
- OpenAI Docs: Developer commands
The file-removal sequence in this guide is a Windows local-state reset procedure. It is presented as a targeted workaround after Codex has been fully stopped, not as a substitute for correcting a genuinely invalid, expired or revoked credential.