✗ codex_cli_workspace_disabled

Signing in to Codex from a ChatGPT Business, Enterprise, or Edu seat can fail with An error occurred during authentication (codex_cli_workspace_disabled). Please try again. The “try again” is a dead end — the code means your workspace has Codex’s local surfaces disabled, and only a workspace admin can turn them on. The exact string was reported on the openai/codex tracker from the desktop app on an Enterprise account.

Symptoms

• Sign-in fails immediately with codex_cli_workspace_disabled in the error text, plus a request ID for support (#17833). One workspace control gates the CLI, IDE extension, and desktop app together (admin rollout guide), so all three surfaces can hit it.
• On headless machines — SSH sessions, containers — the failure reads Please contact your workspace admin to enable device code authentication (#9253).
• Personal ChatGPT accounts sign in fine from the same machine; the block travels with the workspace account, not the install (Ask HN thread).

Cause

Business, Enterprise, and Edu admins control whether members can run Codex locally. With that control off, OpenAI’s auth server rejects the sign-in and returns this code — the client is working as designed. An OpenAI maintainer closed the desktop report within ten minutes as “an account issue, not a bug in Codex”.

The headless variant needs a second toggle: the CLI forces the device-code flow when it detects no browser. In early 2026 that toggle was gated behind an Enterprise-only entitlement, so Business and Team admins could not enable it at all — see the Enterprise plan required rejections on #9253. OpenAI shipped a server-side fix and closed the issue on February 3, 2026.

Fix

1. Send this page to your workspace admin. The control they need, per OpenAI’s admin rollout guide, is “Allow members to use Codex Local” — it governs the CLI, IDE extension, and desktop app in one setting.
2. For headless or SSH use, the admin also enables device code authentication — a maintainer on #9253 pointed admins to the toggle at chatgpt.com/admin/permissions.
3. Once the admin confirms the change, run codex login or retry desktop/IDE sign-in.
4. If it still fails, take the request ID from the error to OpenAI’s help center — the maintainer response on #17833 routes this class of failure to support, not the tracker.
5. While you wait on an admin, users on #9253 reported two unofficial workarounds for the headless variant: copy Codex’s auth.json credential file from a machine where browser login works, or forward the login port with ssh -L 1455:localhost:1455 user@host.

Affected versions

The rejection happens server-side at sign-in, so any build shows it while the workspace setting is off — the desktop report on #17833 came from app version 26.409.1734.0, and the headless reports on #9253 started around CLI 0.84.0. Updating the client changes nothing; the admin toggle does.

Once you’re in, the errors you hit next are the ordinary kind — rate limits first among them. See our limits guide.

Facts on this page verified July 15, 2026.