[bug] OAuth account switching fails on macOS — Claude re-prompts for login, Codex reports a revoked refresh token (v0.3.7)

[danielraffel]

Preconditions

• I read existing issues and this does not appear to be a duplicate.
• I can reproduce this on the latest released version.
• I understand logs and credentials in this issue must be redacted.

Issue Type

Runtime failure (command exits non-zero)

Summary

I cannot get this to work for Claude or Codex.

Steps to Reproduce

Environment
- aisw 0.3.7
- macOS 26.5.2 (Apple Silicon) 
- Claude Code 2.1.209 (OAuth)
- Codex CLI 0.144.1 (OAuth)
- Both tools authenticated via OAuth (subscription accounts), not API keys

What I did (exact steps)
1. aisw init — imported the currently-live credentials as profile primary for both Claude Code and Codex CLI (account-one@example.com). Then logged out of each Claude/Codex CLI.
2. Logged into Claude Code as the second account (account-two@example.com) via the normal login flow, then captured it: aisw add claude second --from-live.
3. Did the same for Codex: logged in as account-two@example.com, then aisw add codex second --from-live.
4. aisw list confirms both profiles exist for both tools; aisw use <tool> <profile> reports success switching between them.

Expected Behavior

What I expected
aisw use claude second / aisw use codex second (and back) switches the active account with no re-login, so I can hop between two accounts on the same machine.

Actual Behavior

What actually happened

• Claude Code: after switching profiles, Claude does not use the switched account — it drops me into the normal login flow and asks me to sign in again, as if no credentials are present. aisw status shows Claude Backend: file, but Claude on macOS stores its auth in the Keychain — is the file-backed switch not writing where Claude actually reads? (aisw status also flags the "permissions too broad.")
• Codex CLI: after switching, Codex fails with:
  ▎ Your access token could not be refreshed because your refresh tog out and sign in again.
  ▎ This looks like the snapshotted OAuth refresh token was rotated/revoked by the provider between capture and restore.

Command Output

Questions
- Is switching between two OAuth subscription accounts possible?
- For Claude on macOS, can profiles be imported from Keychain I get a lot of popups?
- For Codex OAuth, is there a way to avoid the refresh-token-revoing a saved token snapshot, given OAuth refresh tokens rotate onuse?
- Am I doing something wrong? It seems like this does not work.

Diagnostic Output

✓ tool/claude                      /var/folders/8_/REDACTED/T//cmux-cli-shims/REDACTED/claude found (2.1.211 (Claude Code))
  ✓ tool/codex                       /Users/REDACTED/.local/bin/codex found (codex-cli 0.144.4)
  ✗ tool/gemini                      gemini not found on PATH — install it or add it to PATH
  ✓ config/json                      valid (schema v2)
  ✓ keyring                          OS keyring is accessible
  ✓ shell/hook                       hook present in /Users/REDACTED/.zshrc
  ✓ permissions/claude/redactedA     0600 ok
  ✗ permissions/claude/redactedA        credentials file missing: /Users/REDACTED/.aisw/profiles/claude/REDACTED/.credentials.json
  ✓ permissions/codex/redactedB         0600 ok
  ✓ permissions/codex/redactedB           0600 ok
  ✗ permissions/gemini/redacted        credentials file missing: /Users/redacted/.aisw/profiles/gemini/REDACTED/oauth_credentials.json

One or more checks failed.

aisw Version

0.3.7

OS and Version

macOS 26.5.2

Shell

zsh 5.9 (arm64-apple-darwin25.0)

Install Method

Homebrew

Affected Tool Integrations

• Claude
• Codex
• Gemini
• Not tool-specific

Additional Context

No response

[burakdede]

Thanks for the detailed report @danielraffel

I can confirm the issues with latest 0.3.7 version. (Your tool version mismatch in the issue versus diagnostic output doesn't change the conclusion here.)

The two failures have different root cause here:

1. Codex is failing because aisw snapshots and later rewrites ~/.codex/auth.json but it doesn't and can't keep an OAuth refresh token valid once the provider has rotated and revoked it. Reproduce steps explicitly logs out the first account after capture, which is enough to invalidate that saved session. The code/docs also say aisw does not refresh expired OAuth tokens; it only reapplies stored state which matches your revoked-refresh-token error. I believe this is the [change]((b4905f5) introduced this issue.
2. Claude on macOS is failing because aisw restores the Keychain credentials plus only the oauthAccount field from ~/.claude.json But ~/.claude.json also carries Claude's OAuth session state so restored Claude state is incomplete after an account switch and Claude fall backs to login.

I will send two PRs to resolve each issue separately as they are not directly related.

[danielraffel]

Thanks for trying to fix, this tool would be so useful to me. Before I try again I wanted to confirm that this is the intended first-time setup and switching flow before testing the two PRs when they land.

Assume Claude Code and Codex CLI are both already logged into account-1@gmail.com.

brew trust burakdede/tap
brew tap burakdede/tap
brew install aisw
aisw init

During aisw init, I would:

1. Accept the shell integration.
2. Import the currently active Claude credentials as:
   • Profile: account-1
   • Label: account-1@gmail.com
3. Import the currently active Codex credentials as:
   • Profile: account-1
   • Label: account-1@gmail.com
4. Restart the shell or run:

source ~/.zshrc

Then verify:

aisw list
aisw status

Next, I would log Claude and Codex out of account-1@gmail.com, log back into both as account-2@gmail.com, exit the CLIs, and capture the new live credentials:

aisw add claude account-2 --from-live --label account-2@gmail.com
aisw add codex account-2 --from-live --label account-2@gmail.com

Then verify both profiles exist:

aisw list
aisw status

Switch both Claude and Codex to Account 1:

aisw use --all --profile account-1

Switch both Claude and Codex to Account 2:

aisw use --all --profile account-2

A few things I want to confirm:

1. Is this the intended end-to-end flow?
2. Does aisw init import and mark the first live Claude and Codex profiles active, so there is no need to run aisw add ... --from-live for Account 1 afterward?
3. Is logging out of the upstream Claude and Codex CLIs the intended way to expose Account 2 for --from-live capture?
4. After aisw use ..., should I simply start a new Claude/Codex session, or is a new terminal required? Can a previously saved Claude/Codex session from Account 1 be resumed after switching to Account 2?
5. Is brew trust burakdede/tap expected for current Homebrew installations, and should it be included in the README?
6. Will either of the upcoming PRs change this flow?

---

The transition from the first imported account to the second is the part that still feels unclear.

The README doesn't explicitly say that the intended flow is:

1. Exit Claude and Codex.
2. Log out of each upstream CLI.
3. Log back in with Account 2.
4. Run aisw add ... --from-live.

I assume that's the correct workflow and that there isn't another aisw command for introducing a second account, but it isn't stated directly. Since I've tried this a few times over the past month without success, I wasn't sure whether I was missing a step or hitting a bug.

It would also help to explicitly state what happens after the profiles have been captured. After running:

aisw use --all --profile account-1

or

aisw use --all --profile account-2

I should not need to log out or log back into Claude or Codex manually. aisw should restore the saved credentials for me.

Assuming that's accurate, I think the README Quick Start would be much easier to follow as a concrete two-account walkthrough instead of individual command examples. That would make it much easier for someone to verify they're following the intended workflow and determine whether a problem is user error or a bug.

[burakdede]

1. Init Sequence

During aisw init, I would:

That is the normal first-run setup. And yes intended behavior is that init picks up the currently active Claude, Codex and Gemini accounts in the system if those tools are installed and already authenticated.

Two small clarifications

• init imports the account that is live at the moment for each tool. It does not create multiple accounts automatically, it captures just the current one.
• Whether that imported profile is durable switch target depends on the tool/auth model. The import step itself is normal; the later switching guarantees differ by tool.

2. Adding Second Account

Next, I would log Claude and Codex out of account-1@gmail.com, log back into both as account-2@gmail.com, exit the CLIs, and capture the new live credentials:

To bring new pair of Codex/Claude accounts to manage with aisw tied to your account-2@gmail.com after getting account-1@gmail accounts through init.

• Claude: direct aisw add claude account2 is preferrable and should avoid manual logout/login dance
• Codex: direct aisw add codex account2 is not just preferrable, it is the supported durable model for ChatGPT-managed auth.
• --from-live still useful for importing the currently live account, but weaker than direct add for long-term account switching.
• In any case, after switching, users should still start a fresh CLI process. Even if credential switching worked correctly, we should not promise that an already-running Claude/Codex session can be resumed safely across an account change.

3. Quick Fire Questions

Is this the intended end-to-end flow?

Partly. It matches the intended import flow for Claude but not durable recommended flow for ChatGPT-managed Codex. For Codex, direct per-profile login via aisw add codex <name> is the reliable path; --from-live is bootstrap/compatibility only.

Does aisw init import and mark the first live Claude and Codex profiles active, so there is no need to run aisw add ... --from-live for Account 1 afterward?

Yes. If Account 1 was live during aisw init, that should already import it and mark it active.

Is logging out of the upstream Claude and Codex CLIs the intended way to expose Account 2 for --from-live capture?\

Yes, if you are using --from-live.
I would say aisw add codex <profile> and aisw add claude <profile> for Account 2 is the better practice and more preferred workflow.

After aisw use ..., should I simply start a new Claude/Codex session, or is a new terminal required? Can a previously saved Claude/Codex session from Account 1 be resumed after switching to Account 2?

Start a fresh Claude/Codex process after switching. A new terminal is usually not required. I would not rely on reusing an already-running or resumable session that was started under the previous account.

Is brew trust burakdede/tap expected for current Homebrew installations, and should it be included in the README?

Yes for brew. That's a recent change on brew side and good to flag. I will update README

Will either of the upcoming PRs change this flow?

Yes. For Claude, the flow stays broadly similar but the messaging and reliability improve. For Codex, the guidance changes more materially: ChatGPT-managed --from-live imports are treated as bootstrap-only, while direct per-profile login is the durable supported path.

4. Two-Account Workflow

The transition from the first imported account to the second is the part that still feels unclear.

That’s a good callout. The transition from the first imported account to the second needs to be stated much more explicitly in the docs.

The main clarification after the recent changes is that --from-live is still supported, but it is no longer the best default recommendation for introducing a second account when aisw can run the login flow itself.

If you already imported Account 1 during aisw init, the recommended way to add Account 2 is:

aisw add claude account-2 --label account-2@gmail.com
aisw add codex account-2 --label account-2@gmail.com

That is the preferred path because aisw drives the login flow directly and captures the profile in the way it expects. For Codex in particular, that matters because direct add logs in inside the profile’s own isolated CODEX_HOME, which is the durable
supported model for ChatGPT-managed auth.

If you intentionally want to import whichever account is currently live upstream, then --from-live is still the right command, and in that case the flow is:

1. Exit the upstream CLI.
2. Log out upstream.
3. Log back in upstream as the account you want to capture.
4. Run aisw add ... --from-live.

So your interpretation was reasonable, but we need to document that as the live-session import flow, not as the only or primary way to introduce a second account.

After the profiles have been captured, the expected behavior is that:

aisw use --all --profile account-1

or

aisw use --all --profile account-2

restores the saved credentials for the selected profile. You should then start a fresh Claude/Codex process. You should not need to manually log out and log back in again after every switch. A new terminal usually is not required, but I would not rely on
reusing an already-running or resumable session that was started under the previous account.

I agree with your README suggestion. A concrete two-account walkthrough would make this much easier to follow and would make it clearer where the line is between supported flow, compatibility import flow, and actual bugs.