Skip to content
CC Switch WikiUnofficial Community Wiki

auth.json refilled with an existing account's auth.json - Codex

Quick fix

Upgrade to v3.17.0+ and turn off 非接管切换时保留官方登录 (keep official login on non-takeover switch). Back up auth.json before upgrading.

Symptom

Section titled “Symptom”
Error output
尝试删除auth.json，只保留{}，保存后，重新编辑进来，auth.json又填充了已有账号的auth.json
English translation

I tried deleting auth.json and leaving only {}. After saving and reopening it for editing, auth.json had been refilled with an existing account's auth.json.

Cause

Section titled “Cause”

This comes from several cc-switch write paths to the Codex `auth.json` stacking on each other, not from Codex itself being broken. A Codex provider switch/takeover regression introduced in v3.16.0 makes editing a newly created openai official load an existing account's auth.json (#3451/#3491/#3505). With 非接管切换时保留官方登录 (keep the official login when switching without takeover) enabled, switching to a third-party provider carries the API key of whichever provider was active when you turned the option on into the others, so every provider shares one key (#5086). Separately, the proxy takeover restore logic overwrites `auth.json` from an old snapshot when cc-switch quits, losing the official ChatGPT login or forcing a fresh login every time Codex opens (#6000/#4099/#3543/#4688). In the edit dialog, `hasLoadedLive` is only a global boolean and is not bound to provider.id, so without unmounting the dialog it shows the previous provider's key on the next one (#5866, still reproduced by users on v3.19.0). On top of that, #129 is `auth.json.tmp` creation failing due to insufficient `~/.codex` permissions, and #5885 is an OAuth Auth Center key collision between accounts in the same Team workspace — two independent variants.

Fix

Section titled “Fix”

  1. Back up the current `~/.codex/auth.json` (if present) and the cc-switch config directory first, so later steps cannot overwrite them further.

  2. Upgrade cc-switch to at least v3.17.0. v3.16.1 fixed the overwrite path on create/switch and v3.17.0 hardened per-provider key isolation — do not stay on v3.16.0.

  3. Turn off 非接管切换时保留官方登录 (keep the official login when switching without takeover) under 设置 → Codex 增强 / 应用增强 (Settings → Codex enhancements / App enhancements). #5086 confirms auth stops being overwritten once it is off.

  4. Create an openai official, save it empty, then edit it and confirm auth.json is not auto-filled with the old account. If it still happens, check whether proxy takeover or official-auth retention is on, and record your version, settings, and reproduction steps.

  5. If the Codex desktop app shows third-party models as 自定义 (custom): sign in to the official ChatGPT once in Codex desktop so `~/.codex/auth.json` holds official credentials; enable keeping the official login; confirm local routing/route takeover is on for the third-party provider; then quit and restart Codex desktop completely.

  6. If Codex asks you to sign in to ChatGPT every time after cc-switch quits, back up auth.json and upgrade to a version containing the #6277 fix. As a stopgap you can enable routing and then copy-paste over `~/.codex/auth.json`.

  7. If saving auth.json reports `Permission denied`: run `whoami` in a terminal to confirm the current user, run `ls -ld ~/.codex` to see the directory owner and permissions, and use `chown`/`chmod` to make it writable by the current user.

Affected Versions

Section titled “Affected Versions”
ToolCodex
Version3.16.0 - 3.19.0（受影响区间；v3.16.1/v3.17.0 修复部分路径，#5866 在 v3.19.0 仍复现）
PlatformsWindowsmacOS

Source Issues

Section titled “Source Issues”

This page is distilled from 22 real issues

FAQ

Section titled “FAQ”
Which older version switches correctly?
Several reports mention v3.15.0 (#3505) had no key cross-contamination, and v3.12.2 fixed the login overwrite in #188. The model picker showing 自定义 (custom) is a Codex desktop limitation that older versions cannot really solve either. Prefer upgrading to v3.17.0 and verifying with official-login retention turned off.
I configured auth.json — why does the model test keep saying the api key is missing?
Neither the model test nor proxy mode supports signing in with an official account, as a ban-risk precaution. Add the OpenAI official provider first, switch to it, then run `codex` in a terminal and complete the login flow once; the token is written to `auth.json`, after which switching provider should work.
Why does the Codex desktop model picker show 自定义 (custom), greyed out and unswitchable?
This is an upstream Codex desktop limitation: third-party custom models only appear with an official ChatGPT login present. Sign in to the official account once in Codex desktop, enable keeping the official login when switching to a third party, confirm local routing/route takeover is on for that provider, then quit and restart Codex desktop completely. Running `codex debug models` in a terminal showing the models means the data layer is fine.
Why does Codex ask me to sign in to ChatGPT again every time after cc-switch quits?
The proxy takeover restore logic may overwrite `auth.json` from an old snapshot when cc-switch quits (#6277), so a login you performed after takeover was enabled gets overwritten. Upgrade to a version containing the #6277 fix. As a stopgap, back auth.json up before quitting, or enable routing and copy-paste auth.json over it.
Why does a second member of the same Codex OAuth Auth Center Team workspace overwrite the first?
The account storage key appears to be based on the workspace/account id rather than a unique user credential id, so members of the same workspace collide. Accounts in separate workspaces work fine. This is not fixed yet and awaits follow-up.
Saving auth.json reports Permission denied. What now?
Run `whoami` in a terminal to confirm the current user, then `ls -ld ~/.codex` to see the directory owner and permissions. Use `chown`/`chmod` to make `~/.codex` writable by the current user.
Section titled “Related problems”
Nothing happens, cannot sign in to the official channel - CodexUpgrade cc-switch to v3.16.2 or newer and delete the .codex and .cc switch folders in your home directory, fixing auth.json being overwritten.3 issues mergedbuilt-in provider IDs: openai - CodexUpgrade CC Switch to v3.16.4+, delete the old config and save again. Enable unified Codex session history and use openai_base_url.3 issues mergedGeneral config has no effect and gets overwritten by earlier config - Codex CC SwitchUpgrade to CC Switch v3.17.0+ to fix Codex general-config merging. If an old snapshot still overwrites it, switch to another provider and back to self-heal.21 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.