✗ stream error: exceeded retry limit, last status: 401 Unauthorized

Codex retries a failed request five times, then gives up with stream error: exceeded retry limit, last status: 401 Unauthorized. A 401 means the server rejected the credential Codex sent, so this is an authentication problem — unlike a 429, which is a usage-limit problem (see /limits/ if that’s what you’re hitting).

Symptoms

• The session dies after a visible retry ramp — retrying 1/5 in 211ms… with growing backoff — then the 401 line.
• It hits every auth mode: API keys, ChatGPT/OAuth sign-in, and business access tokens.
• ChatGPT on the web can keep working while Codex fails — one VS Code reporter confirmed exactly that, because the web session uses a separate credential.

Cause

Three documented causes, each with its own fix path:

1. A stale or corrupt ~/.codex/auth.json. A wave of these hit VS Code and Cursor users after the gpt-5-codex release; the stored token stops being accepted.
2. An OPENAI_API_KEY environment variable outranking your OAuth token. Issue #15151 documents the CLI silently preferring the env var even when you signed in with ChatGPT, producing a misleading missing-scopes 401.
3. Business access tokens broken upstream. Issue #25246, an open tracker, reports tokens from the ChatGPT admin panel failing across old and new Codex versions alike — which points server-side.

Fix

1. Quit your IDE (or end the CLI session) completely.
2. Move the auth file aside: mv ~/.codex/auth.json ~/.codex/auth.json.bak.
3. Relaunch and sign back in with ChatGPT. Multiple forum repliers confirm this alone resolves it.
4. Still 401? Check for a lurking key: echo $OPENAI_API_KEY. If it’s set, unset OPENAI_API_KEY and rerun — #15151’s reporter aliased codex to unset it first as a permanent workaround.
5. If you authenticate via a business access token (CODEX_ACCESS_TOKEN), skip local debugging. That failure is tracked upstream with no user-side fix; subscribe to the issue instead.

These steps don’t rescue every case — one enterprise OAuth user on VS Code tried re-login, auth.json deletion, and reinstalls without success, and that report remains open.

Affected versions

Reports span CLI 0.27.0 (August 2025) through 0.135.0 (May 2026), plus VS Code extension 0.4.58. This is a recurring error class keyed to auth state, not a single broken release.

Facts on this page verified July 15, 2026.