Skip to content
CC Switch WikiUnofficial Community Wiki

Your access token could not be refreshed - Codex

Quick fix

Upgrade cc-switch to v3.17.0+, which fixes the PROXY_MANAGED placeholder polluting OAuth credentials or causing a 401 during takeover.

Symptom

Section titled “Symptom”
Error output
Your access token could not be refreshed because your refresh token was already used. Please log out and sign in again.

Cause

Section titled “Cause”

With local route takeover enabled, early cc-switch versions wrote PROXY_MANAGED into the config file (the Codex auth.json, or the Claude Code settings.json) as a placeholder marking the takeover. For Codex using an official OAuth login, that placeholder pollutes or overwrites the existing login credential so the token refresh fails. For the Codex OAuth case in Claude Code, the takeover logic wrongly deletes ANTHROPIC_AUTH_TOKEN and triggers a login prompt. And if the placeholder is left behind and sent as-is to an official endpoint or a third-party openai_chat backend, it produces a 401. The takeover logic was reworked in v3.17.0 to stop writing the placeholder and to preserve the real credentials.

Fix

Section titled “Fix”

  1. Upgrade cc-switch to v3.17.0 or newer. That version reworked official session takeover routing, no longer writes the placeholder, and actively cleans up any leftover PROXY_MANAGED.

  2. If you cannot upgrade yet and the official Codex login broke, clean the placeholder out of ~/.codex/auth.json by hand and run the OAuth login again.

    // ~/.codex/auth.json
    {
      "OPENAI_API_KEY": "PROXY_MANAGED"
    }

  3. If Claude Code prompts you to log in, add the ANTHROPIC_AUTH_TOKEN field back into env in ~/.claude/settings.json by hand.

    // ~/.claude/settings.json
    {
      "env": {
        "ANTHROPIC_API_KEY": "PROXY_MANAGED",
       "ANTHROPIC_AUTH_TOKEN": ""
      }
    }

Affected Versions

Section titled “Affected Versions”
ToolCodex
VersionUnknown
PlatformsmacOSWindows

Source Issues

Section titled “Source Issues”

This page is distilled from 5 real issues

FAQ

Section titled “FAQ”
Why does my third-party provider (sglang, for example) report 401 Unauthorized once takeover is on?
Early versions of the proxy forwarder sent PROXY_MANAGED to an openai_chat backend without substituting the real API key. Upgrade to v3.17.0+, or write the real API key into ~/.claude/settings.json by hand for now.
I use the JS Codex CLI — why does takeover prompt me to log in and leave the model config not applying?
Early versions only supported the Rust Codex config format (config.toml); the JS build cannot read the PROXY_MANAGED placeholder or .toml config. Set the environment variable CODEX_RUST=1 to standardise on the Rust build, or wait for support in a later version.
Section titled “Related problems”
settings.json Full Overwrite Causes Plugin FailureUpgrade to v3.20.1+ to fix the bug that clears enabledPlugins when switching configs.9 issues mergedGtk-CRITICAL: gtk_widget_get_scale_factor failedOn a GTK assertion failure running cc-switch under Linux or WSL2, edit settings.json to turn silent startup off, or clean the leftovers and reinstall.3 issues merged401 Unauthorized: Incorrect API key providedAfter switching to OpenAI Official or turning the proxy off, clear the leftover third-party OPENAI_API_KEY from ~/.codex/auth.json and restart Codex.2 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.