Codex suffered a full outage in the early hours of September 26, 2026. Starting around 6:58 AM Beijing time, users signed in with ChatGPT accounts saw "Unexpected status 401 Unauthorized: Incorrect API key provided" across the web app, CLI, VS Code extension, and API. OpenAI's status page timeline shows the incident was confirmed as a full Codex outage at 10:58 PM UTC on September 25 and fully resolved by 11:54 PM — lasting about 56 minutes.
The timeline
- 10:58 PM UTC, Sep 25: confirmed as a full Codex outage, affecting Web, CLI, VS Code extension, and API;
- 11:19 PM: OpenAI said logging in with an API key could temporarily bypass the failure;
- 11:34 PM: root cause found, mitigation underway;
- 11:45 PM: mitigation applied, recovery under observation;
- 11:54 PM: all affected services back to normal.
The key in the error message isn't yours — it's theirs
The most confusing part was the error itself. A 401 usually means "your key is wrong," but the affected users were all on ChatGPT OAuth login and had never configured an API key manually. The key starting with sk-svcac in the error message was Codex's own backend service key — OpenAI's own "internal pass" issued to Codex had broken, while users' login sessions were fine.
That also explains why every self-rescue attempt failed: re-logging in, clearing caches, switching networks, updating clients — none of it could get around a server-side check. Issue #48235 soon appeared in the openai/codex GitHub repository, and a thread in the official developer community confirmed within minutes that "Codex is down." Some ChatGPT web users also hit "Error in message stream," though regular chats mostly worked.
The Codex lead acknowledged the incident on X. Notably, the official workaround — logging in with an API key — hints at at least two credential paths inside Codex: the OAuth-bound one broke, the API-key one survived.
The drama was in the timing: just hours earlier, OpenAI had published a blog post admitting its agents had sent data they shouldn't have during training. Confession first, then its flagship coding agent went down across the board — some users joked in the incident thread that this was OpenAI's "work-life balance feature," clocking everyone out on a Friday afternoon.
Jokes aside, the serious takeaway is different: AI coding agents like Codex are now deeply embedded in developers' daily workflows, and a sub-one-hour authentication failure can bring users worldwide to a halt at once. The meaning of a 401 is also worth remembering — it's not the model getting "dumber" or "overloaded"; the request never passed identity verification, so the model was never even invoked. From the user's perspective "the AI is down"; from the system's perspective "the door never opened."
For ordinary users, the practical lesson is concrete: when you hit a 401, don't rush to fiddle with your own keys and configs — check the status page first. It might just be the provider's problem.
