Agent login not working? Diagnose Codex, Claude Code and Cursor safely

When an agent cannot sign in, first identify the runtime and active account, then separate authentication from product access, remaining allowance and network failures. Repeatedly logging in or adding an API key can obscure the cause and change the billing route without fixing the original problem.

Checked 8 November 2026 against current provider documentation. The procedure below is a conservative diagnostic checklist, not a claim that we reproduced an outage or tested every integration. It covers native Codex, Claude Code and Cursor, with one Hermes-specific recovery boundary.

What failed before you changed anything?

Write down where the failure occurred. Did the browser reject the account? Did the browser succeed but the terminal never resume? Did the agent accept the session and then refuse a model request? Did a tool fail only after the model started answering?

Observed stage	Check next	Avoid assuming
Account sign-in fails in the browser	Correct account and organization sign-in requirements	That buying more usage fixes identity
Browser completes, CLI still waits	Callback or supported headless-login route	That the provider rejected the password
Session opens, model request is refused	Entitlement, workspace controls, allowance and service status	That every refusal means an expired token
Native CLI works, wrapper fails	Wrapper runtime, host and saved connection	That both processes share authentication
Model answers, a tool is denied	Tool permissions and that service’s connection	That the model account needs replacing

This table is a diagnostic aid, not an exhaustive mapping of HTTP codes. A status number alone does not tell you which layer returned it. Keep the surrounding error category and the time it happened, with secrets removed.

Pause scheduled retries while investigating. Preserve the draft or working files before signing out, changing providers or updating software. Avoid turning one failure into several configuration changes that you cannot disentangle.

How do you confirm the runtime and funding route?

Use the product’s own status screen or documented command rather than opening credential files. OpenAI’s authentication guide documents codex login status. It distinguishes ChatGPT subscription sign-in from API-key access, which has usage-based billing.

Cursor’s CLI reference documents agent status. Check it in the same environment as the failing agent. A terminal on your laptop is not the same process as a container or remote host.

For Claude Code, Anthropic’s authentication page distinguishes claude.ai, Console and cloud-provider routes, and notes that administrators can restrict the login method or organization. Confirm the intended route before reauthenticating. Do not delete organization-managed configuration to force a personal sign-in.

In a wrapper, record both names: the app you opened and the runtime it launched. T3 Code and Munder Difflin can organize different agents, so the visible workspace name alone does not identify the paying account. Ask the app to show the selected integration; do not assume it inherits the last CLI login you used elsewhere.

What if browser sign-in succeeds but the terminal stays stuck?

Treat the return path as a separate check. OpenAI’s guide identifies remote or headless environments and blocked localhost callbacks as cases where browser login may fail to complete. It documents codex login --device-auth as the preferred alternative in those cases, subject to the account or workspace enabling device-code login.

Use the official sign-in page shown by the CLI. Enter a device code only in that authorization flow, never into a support chat. If your organization disables that method, ask its administrator which route is permitted rather than bypassing the restriction.

For Cursor, the authentication guide offers NO_OPEN_BROWSER=1 agent login when the browser cannot open. That prints a URL; it does not by itself prove that an SSH host’s return path will work. Follow the product’s current remote-login instructions instead of exposing a callback port publicly.

Do not disable TLS verification as a routine fix. If a corporate proxy or certificate policy is involved, provide the network administrator with the host and error category, not your authentication cache.

When should you reauthenticate instead of checking usage?

Reauthenticate when the product identifies a missing, expired or revoked sign-in. Anthropic documents /logout followed by starting claude again; it also warns that logout resets first-launch setup state. Record the intended organization first.

Hermes is an important counterexample to the assumption that installing Codex fixes every Codex-provider login. Its provider guide documents its own stored authentication and quarantines terminal refresh failures such as invalid_grant. Its recovery command is hermes auth add openai-codex, not a loop of repeated task retries. See the Hermes setup guide for that integration’s full procedure.

If login succeeds and a request then reaches a usage boundary, use the provider’s usage controls instead. The per-app ChatGPT limits guide covers app caps and funding permission. Reauthentication should not be presented as a way to refill allowance.

Check the relevant provider status page when several sessions fail at once. A community report can suggest what to investigate, but it does not establish that your error is a current outage. Do not switch a subscription task to API billing simply because someone else reported that workaround.

What can you safely send to support?

Send a small diagnostic packet: app and runtime versions, operating system, selected provider, failure stage, redacted error, timestamp with timezone, and whether a native session on the same host also fails. Describe whether the account is personal or organization-managed without publishing its identifiers.

Remove bearer tokens, browser callback URLs, one-time codes, cookies and authentication-file contents. Inspect screenshots for private projects and account details. If support needs a log, review it locally and use the provider’s private support channel rather than posting the raw file publicly.

After a fix, run one supervised, non-sensitive read-only task. Confirm the intended account and route, then resume scheduling only after the result is inspectable. That test is a recommended acceptance check, not a guarantee of future availability.

If the problem was an unsupported integration rather than a broken login, return to the Claude subscription guide or subscription setup guide. A working credential is not permission to route it through any harness.