Atlas fails an OpenAI/Codex login with "Token exchange failed: <status>", "Token refresh failed: <status>", or "Failed to initiate device authorization" because the codex plugin throws on any non-ok response from the device-authorization, token-exchange, and token-refresh endpoints, embedding the HTTP status in the message. The fix is to re-run atlas auth login and pick OpenAI again to restart the flow. A 400 usually means a stale or reused authorization code, so do not reuse an old browser tab.
Why does Atlas say Token exchange failed for OpenAI Codex
Atlas says "Token exchange failed: <status>" for OpenAI Codex because the codex plugin throws on any non-ok response from the token-exchange endpoint and embeds the HTTP status in the message. The plugin does the same across all 3 endpoints, device-authorization, token-exchange, and token-refresh, each with its own message.
Three endpoints, three messages, one pattern. The codex plugin in Atlas checks every response and refuses to continue on a non-ok one, carrying the HTTP status forward so you are never debugging blind. "Failed to initiate device authorization" means the flow never started. "Token exchange failed: <status>" means the authorization code was rejected when Atlas tried to trade it for tokens. "Token refresh failed: <status>" means an existing session could not renew. Identify which message you actually got, because the three sit at different points in the login lifecycle and have different causes.
What a 400 on OpenAI Codex token exchange means
A 400 on an Atlas OpenAI Codex token exchange usually means a stale or reused authorization code. Authorization codes are single-use and short-lived, so completing the flow from an old browser tab, or retrying with a code Atlas already redeemed, produces exactly that 400 from the token-exchange endpoint.
The most common way to hit this is to leave an old OpenAI approval tab open, come back to it later, and finish the flow there. That tab is carrying a code that has either expired or already been spent. Close it. Re-run `atlas auth login`, pick OpenAI again, and complete the approval in the fresh tab Atlas opens, without detouring through browser history. Because the codex plugin embeds the status in the message, a repeat 400 tells you unambiguously that a stale code is still being submitted rather than that your account is misconfigured.
What a 401 on OpenAI Codex token refresh means
A 401 on an Atlas OpenAI Codex token refresh means the stored refresh token was revoked. Remove the auth entry and log in again, because the codex plugin will keep presenting the same dead refresh token to the token-refresh endpoint and keep getting "Token refresh failed: 401" back.
A revoked refresh token cannot be repaired. Whatever revoked it, a rotated credential, a changed account state, or an explicit revocation, the stored value is now worthless and the only path forward is a new one. Delete the OpenAI auth entry so Atlas is not holding the dead token, then run `atlas auth login` and pick OpenAI again to mint a fresh set. Note the honest distinction: a 401 on refresh is not the same as a 400 on exchange, and re-running the flow without removing the revoked entry can leave the old credential in place.
How to verify the OpenAI Codex login fix worked
Verify the OpenAI Codex fix in Atlas by re-running `atlas auth login`, picking OpenAI, completing the browser approval, and confirming no "Token exchange failed: <status>" appears. Then select an OpenAI model and send a message, since a clean exchange and a working model are 2 separate facts.
Check the refresh path as well as the exchange path. The initial exchange proves the authorization code was accepted. The refresh path only exercises later, when the access token ages out, so a session that keeps working for a while without "Token refresh failed: <status>" is the stronger signal. Atlas lets you switch the active model and provider on the fly with favorites and recents, so re-selecting an OpenAI model to confirm the credential works takes a single action.
How to fix it
- 01Re-run `atlas auth login` and pick OpenAI again to restart the flow from the beginning.
- 02A 400 usually means a stale or reused authorization code. Do not reuse an old browser tab, and complete the fresh flow in the tab Atlas opens.
- 03A 401 on refresh means the stored refresh token was revoked. Remove the auth entry and log in again.
- 04If the device authorization itself cannot start, check egress to the OpenAI auth host. "Failed to initiate device authorization" means the flow never began.
Frequently asked questions
- How do I fix Token exchange failed on OpenAI in Atlas
- Re-run `atlas auth login` and pick OpenAI again to restart the flow. The codex plugin throws on any non-ok response from the token-exchange endpoint and embeds the HTTP status in the message.
- Why do I get a 400 on OpenAI Codex token exchange in Atlas
- A 400 usually means a stale or reused authorization code. Do not reuse an old browser tab. Re-run the login and complete the approval in the fresh tab Atlas opens.
- What does Token refresh failed 401 mean in Atlas
- A 401 on refresh means the stored refresh token was revoked. Remove the auth entry and log in again, since the codex plugin will otherwise keep presenting the same dead token.
- What does Failed to initiate device authorization mean
- The OpenAI Codex device-authorization endpoint returned a non-ok response, so the login flow never started. Check egress to the OpenAI auth host, because no authorization code was ever issued.
- Which OpenAI Codex endpoints can fail during Atlas login
- Three: device-authorization, token-exchange, and token-refresh. The codex plugin throws on any non-ok response from each of them and embeds the HTTP status in the message it raises.
- Should I retry an OpenAI Codex token exchange failure in Atlas
- Retry only by restarting the whole flow with `atlas auth login`. Retrying with the same authorization code produces another 400, because authorization codes are stale once used.
Try SeaShell in your terminal
The terminal-native AI coding agent. Free core, single binary.
Install SeaShellRelated guides
Atlas with Gemini 2.5 Pro in 2026
In 2026, Atlas developers can leverage Gemini 2.5 Pro for long-context coding tasks. It offers a 1M token window at $1.25/Mtok input, making it cost-effective for reading code.
Atlas with GPT-5 Nano in 2026
Drive Atlas with OpenAI's GPT-5 Nano in 2026. Leverage its 400K token context and $0.05/Mtok input cost for efficient summarization and subagent tasks, while understanding its limitations for complex main agent work.
Atlas with Grok Build 0.1 in 2026
Explore Grok Build 0.1 from xAI, a coding-specialized model with a 256K context window, designed for large single-turn patches. Learn its strengths, tradeoffs, and how to integrate it with Atlas for your development
Atlas for Haskell in 2026
Atlas is a terminal-native AI coding agent for Haskell in 2026. Run it in a project with a .cabal file or a stack.yaml, let cabal build drive it, and review the diff.
Atlas vs Warp: Terminal AI Coding Agents in 2026
Comparing Atlas, the terminal-native AI coding agent, with Warp, a Rust-based smart terminal with AI Agent Mode, for developers in 2026.
Atlas with Qwen3.6 Flash in 2026
Drive Atlas with Qwen3.6 Flash, Alibaba's cost-effective 1M token model for 2026. Leverage its strong coding lineage for terminal-native AI coding agent tasks, balancing price and performance.
Atlas vs OpenHands: Terminal AI Coding Agents in 2026
Comparing Atlas and OpenHands in 2026 for AI coding agents. Atlas offers terminal-native TUI and explicit change review, while OpenHands provides an open-source platform with skills and a limited free cloud tier.
Atlas with North Mini Code in 2026
Explore Atlas with North Mini Code, Cohere's 2026 code-specialist model. Benefit from its 256,000 token context, 64,000 token output, and $0 pricing for large refactors.