Codex: "An error occurred during authentication (codex_cli_workspace_disabled)"

Why it happens

Codex local access is controlled per workspace. When an admin has it off, or your role does not include it, the sign-in flow returns this error code instead of a token. An OpenAI maintainer closed issue #17833 with "This sounds like an account issue, not a bug in Codex."

1. The workspace setting that allows members to use Codex locally is off. Depending on the workspace layout it is labelled "Allow members to use Codex locally" or the combined "Allow members to use Codex and Work Locally".
2. Codex is enabled, but only for some roles or groups through role-based access control, and your account is not in one of them.
3. You signed in to the wrong workspace. If you belong to both a personal and a company workspace, the company one may block Codex while the personal one would not.
4. Your organisation pins Codex to specific workspaces or login methods through managed config (forced_chatgpt_workspace_id, forced_login_method), so the workspace you picked is not permitted.

The fix

1. 1 Run codex logout, then sign in again and pick the intended workspace on the ChatGPT account screen.
2. 2 Run codex login status to confirm which method and account Codex is using.
3. 3 Ask a workspace admin to turn on Allow members to use Codex locally in the workspace settings, and to check that your role or group includes Codex.
4. 4 On a headless or SSH machine, use codex login --device-auth, which some workspaces also require the admin to enable.
5. 5 If your company allows Platform API usage, sign in with an API key instead: printenv OPENAI_API_KEY | codex login --with-api-key. Usage is then billed to that API organisation, not the ChatGPT seat.

What to send your admin

Give them the full error text with the request ID, the client you used (Codex app, CLI or IDE extension) and the workspace name you selected. Ask them to confirm three things: that the workspace allows Codex locally, that your role or group has Codex access, and whether a managed Codex config restricts login method or workspace.

Codex cloud and local Codex can be governed separately, so having one working does not mean the other is allowed.

Still failing?

• Wait a few minutes after the admin changes the setting, then sign out and in again so a fresh token is issued.
• If an API key login is refused too, check for a managed config that sets forced_login_method to chatgpt.
• If the admin confirms everything is enabled, contact OpenAI support at help.openai.com with the request ID from the error.

Related errors

• Hermes Codex token refresh failed (401)
• Codex "stream disconnected before completion"