What should I do if I receive the error "Token exchange failed: token endpoint returned status 403 Forbidden"?

Codex login error analysis: "Token exchange failed: token endpoint returned status 403 Forbidden" - several reasons

1. One of the fastest and most important solutions is to switch VPN regions. This is the most common

1. Codex version update
2. Scope/Audience is not allowed

The token endpoint returns 403 when an unauthorized custom scope/resource audience is requested or administrator consent is missing.

1. Organization/Conditional Access Policy Interception

Enterprise policies such as tenant restrictions, IP/region/device compliance, and MFA/CSRF verification directly deny access (common in enterprise/team environments).

1. Local environment interference

Redemption failures may occur due to incomplete/expired local credential cache (such as ~/.codex), old CLI versions, browser privacy extensions/third-party cookie blocking.

1. API Key branch interferes with Codex login

When the environment variable OPENAI_API_KEY exists, the wrong branch is taken and the ChatGPT account login flow is not triggered, resulting in 403.