Codex: Sign-in Could Not Be Completed
When you sign in to Codex with ChatGPT, the CLI, IDE extension or app opens a browser, you log in, and the browser hands your credentials back to Codex through a callback on your own machine (the CLI listens on localhost port 1455 by default). 'Sign-in could not be completed' means that hand-back failed. The most common reasons are documented by OpenAI: the callback cannot reach Codex because you are on a remote, headless or containerized machine, or because local networking or security software blocks the localhost callback; a corporate proxy that inspects TLS breaks the token exchange; your account must set up multi-factor authentication before it can use Codex; or your organization restricts Codex to a particular login method or workspace. OpenAI also provides a device code login for exactly these situations, and Codex writes a dedicated login log you can check to see which step failed.
Affiliate link, we may earn a commission at no extra cost to you.
Symptoms You Might See
The browser login succeeds but Codex shows 'Sign-in could not be completed'
The browser cannot load a localhost page at the end of sign-in
Login works on your laptop but not over SSH, in a container or in WSL
The error mentions token exchange failed or error sending request
Codex logs you out and exits right after sign-in
Common Causes
The localhost callback is blocked or unreachable
OpenAI's docs note that local networking configuration can block the localhost callback Codex uses to receive the OAuth token. On remote or headless machines the browser and Codex are on different computers, so the callback cannot connect.
Corporate TLS proxy
Networks that re-sign HTTPS need Codex to trust the company root certificate during login, otherwise the token exchange fails.
MFA not set up
OpenAI requires multi-factor authentication for Codex cloud when you log in with email and password, including accounts that have email and password as one of several login methods.
Workspace or login method restrictions
Admins can force ChatGPT or API key login and restrict users to one workspace. If your credentials do not match, Codex logs you out and exits.
Step-by-Step Fixes
Use device code login
When to try: First on remote, headless or locked-down machines
In the login screen choose Sign in with Device Code, or run codex login --device-auth. Open the link on any device, sign in, and enter the one-time code. You may first need to enable device code login in your ChatGPT security settings, or ask a workspace admin to allow it.
Forward the callback port over SSH
When to try: When you use Codex on a remote server
If you work over SSH, connect with ssh -L 1455:localhost:1455 user@remote, then run codex login in that session and open the printed address on your local machine.
Copy a working login
When to try: When device code login is not available
Sign in on a machine with a browser, then copy ~/.codex/auth.json to the same path on the headless machine. Treat the file like a password.
Set your corporate CA certificate
When to try: On corporate networks
Behind TLS inspection, set CODEX_CA_CERTIFICATE to your company's root certificate PEM file before running codex login.
Set up MFA on your ChatGPT account
When to try: When Codex cloud refuses your account
If you log in with email and password, enable multi-factor authentication in ChatGPT security settings. If you use Google, Microsoft or Apple sign-in, enable it with that provider.
Read the login log
When to try: When you cannot tell which step fails
Direct codex login runs write a codex-login.log file in your Codex log directory. It shows which step failed and is what support will ask for.
Check with your workspace admin
When to try: On company or school accounts
If Codex logs you out right after sign-in, your organization may enforce a login method or workspace. Ask the admin which one to use.
How to Prevent This
Use device code login by default on servers and containers
Set CODEX_CA_CERTIFICATE once on corporate machines
Keep MFA enabled on the account you use for Codex
Know which workspace your organization expects you to use
When to Contact Support
Contact OpenAI support if device code login also fails, MFA is set up, and you are not under workspace restrictions. Attach the relevant lines from codex-login.log with tokens removed.
Frequently Asked Questions
Why does Codex sign-in fail after I log in in the browser?▼
The browser could not hand your credentials back to Codex, usually because the localhost callback is blocked or Codex is running on a different machine. Device code login avoids the callback.
How do I log in to Codex on a server without a browser?▼
Run codex login --device-auth and complete the code flow on any device, forward port 1455 over SSH, or copy auth.json from a machine where you already signed in.
What is port 1455 in Codex?▼
It is the default localhost port the Codex CLI listens on to receive your login token from the browser.
Do I need MFA for Codex?▼
For Codex cloud with email and password login, yes. If you use social login, OpenAI recommends enabling MFA with that provider.
Where are Codex login logs?▼
Direct codex login runs write a codex-login.log file under your configured Codex log directory.
Sources and verification
Product behavior and limits can change. These primary sources were used to verify this guide.
Other Common AI Errors
ChatGPT Not Working
Service Issues
🚦Rate Limit Exceeded
Usage Limits
📏Context Length Exceeded
Input Limits
🔥Model Overloaded
Service Issues