Atlas fails an OpenAI/Codex login with "Token exchange failed: <status>", "Token refresh failed: <status>", or "Failed to initiate device authorization" because the codex plugin throws on any non-ok response from the device-authorization, token-exchange, and token-refresh endpoints, embedding the HTTP status in the message. The fix is to re-run atlas auth login and pick OpenAI again to restart the flow. A 400 usually means a stale or reused authorization code, so do not reuse an old browser tab.
Why does Atlas say Token exchange failed for OpenAI Codex
Atlas says "Token exchange failed: <status>" for OpenAI Codex because the codex plugin throws on any non-ok response from the token-exchange endpoint and embeds the HTTP status in the message. The plugin does the same across all 3 endpoints, device-authorization, token-exchange, and token-refresh, each with its own message.
Three endpoints, three messages, one pattern. The codex plugin in Atlas checks every response and refuses to continue on a non-ok one, carrying the HTTP status forward so you are never debugging blind. "Failed to initiate device authorization" means the flow never started. "Token exchange failed: <status>" means the authorization code was rejected when Atlas tried to trade it for tokens. "Token refresh failed: <status>" means an existing session could not renew. Identify which message you actually got, because the three sit at different points in the login lifecycle and have different causes.
What a 400 on OpenAI Codex token exchange means
A 400 on an Atlas OpenAI Codex token exchange usually means a stale or reused authorization code. Authorization codes are single-use and short-lived, so completing the flow from an old browser tab, or retrying with a code Atlas already redeemed, produces exactly that 400 from the token-exchange endpoint.
The most common way to hit this is to leave an old OpenAI approval tab open, come back to it later, and finish the flow there. That tab is carrying a code that has either expired or already been spent. Close it. Re-run `atlas auth login`, pick OpenAI again, and complete the approval in the fresh tab Atlas opens, without detouring through browser history. Because the codex plugin embeds the status in the message, a repeat 400 tells you unambiguously that a stale code is still being submitted rather than that your account is misconfigured.
What a 401 on OpenAI Codex token refresh means
A 401 on an Atlas OpenAI Codex token refresh means the stored refresh token was revoked. Remove the auth entry and log in again, because the codex plugin will keep presenting the same dead refresh token to the token-refresh endpoint and keep getting "Token refresh failed: 401" back.
A revoked refresh token cannot be repaired. Whatever revoked it, a rotated credential, a changed account state, or an explicit revocation, the stored value is now worthless and the only path forward is a new one. Delete the OpenAI auth entry so Atlas is not holding the dead token, then run `atlas auth login` and pick OpenAI again to mint a fresh set. Note the honest distinction: a 401 on refresh is not the same as a 400 on exchange, and re-running the flow without removing the revoked entry can leave the old credential in place.
How to verify the OpenAI Codex login fix worked
Verify the OpenAI Codex fix in Atlas by re-running `atlas auth login`, picking OpenAI, completing the browser approval, and confirming no "Token exchange failed: <status>" appears. Then select an OpenAI model and send a message, since a clean exchange and a working model are 2 separate facts.
Check the refresh path as well as the exchange path. The initial exchange proves the authorization code was accepted. The refresh path only exercises later, when the access token ages out, so a session that keeps working for a while without "Token refresh failed: <status>" is the stronger signal. Atlas lets you switch the active model and provider on the fly with favorites and recents, so re-selecting an OpenAI model to confirm the credential works takes a single action.
How to fix it
- 01Re-run `atlas auth login` and pick OpenAI again to restart the flow from the beginning.
- 02A 400 usually means a stale or reused authorization code. Do not reuse an old browser tab, and complete the fresh flow in the tab Atlas opens.
- 03A 401 on refresh means the stored refresh token was revoked. Remove the auth entry and log in again.
- 04If the device authorization itself cannot start, check egress to the OpenAI auth host. "Failed to initiate device authorization" means the flow never began.
Frequently asked questions
- How do I fix Token exchange failed on OpenAI in Atlas
- Re-run `atlas auth login` and pick OpenAI again to restart the flow. The codex plugin throws on any non-ok response from the token-exchange endpoint and embeds the HTTP status in the message.
- Why do I get a 400 on OpenAI Codex token exchange in Atlas
- A 400 usually means a stale or reused authorization code. Do not reuse an old browser tab. Re-run the login and complete the approval in the fresh tab Atlas opens.
- What does Token refresh failed 401 mean in Atlas
- A 401 on refresh means the stored refresh token was revoked. Remove the auth entry and log in again, since the codex plugin will otherwise keep presenting the same dead token.
- What does Failed to initiate device authorization mean
- The OpenAI Codex device-authorization endpoint returned a non-ok response, so the login flow never started. Check egress to the OpenAI auth host, because no authorization code was ever issued.
- Which OpenAI Codex endpoints can fail during Atlas login
- Three: device-authorization, token-exchange, and token-refresh. The codex plugin throws on any non-ok response from each of them and embeds the HTTP status in the message it raises.
- Should I retry an OpenAI Codex token exchange failure in Atlas
- Retry only by restarting the whole flow with `atlas auth login`. Retrying with the same authorization code produces another 400, because authorization codes are stale once used.
Try Atlas in your terminal
The terminal-native AI coding agent. Free core, single binary.
Install AtlasRelated guides
Atlas with Gemini 2.5 Pro: The Cheap 1M Context Default in 2026
Gemini 2.5 Pro in Atlas: a stable GA id with a 1,048,576 token window at $1.25 per Mtok input, 37 percent cheaper to read with than Gemini 3 Pro.
Atlas with GPT-5 Nano: The Cheapest Model in the OpenAI Registry in 2026
GPT-5 Nano in Atlas: $0.05 per Mtok input and $0.40 per Mtok output, the cheapest model in the OpenAI registry, and the right pick for the small_model slot.
Atlas with Grok Build 0.1: xAI's First Coding-Agent Model (2026)
Grok Build 0.1 runs in Atlas at $1 / $2 per Mtok with a 256K context and 256,000 max output tokens. A coding-specialized model, but it is a 0.1 release.
Atlas for Haskell in 2026
Atlas is a terminal-native AI coding agent for Haskell in 2026. Run it in a project with a .cabal file or a stack.yaml, let cabal build drive it, and review the diff.
Atlas vs Warp: Choosing Your AI Coding Agent in 2026
Compare Atlas, the terminal-native AI coding agent, with Warp, a smart terminal with AI Agent Mode, for developers in 2026. Evaluate features, privacy, and workflow.
Atlas with Qwen3.6 Flash: A $0.1875 Speed Tier With Coding Lineage in 2026
Qwen3.6 Flash in Atlas: Alibaba's April 2026 speed tier at $0.1875 / $1.125 per Mtok with a 1M window, wired to small_model in atlas.json. Setup and tradeoffs.
Atlas vs OpenHands: Terminal AI Coding Agents in 2026
Atlas and OpenHands comparison for 2026. Explore terminal-native TUI, self-hosting, code indexing, change review, and pricing models for AI coding agents.
Atlas with North Mini Code in 2026: A 64,000 Token Output Budget
North Mini Code gives Atlas a 256,000 token context and a 64,000 token output, 8x Command A's 8,000, listed at $0 per Mtok on both input and output in the registry.