[vishr]

Codex processes share one stored Fanout login. When two refresh at once, the second presents the refresh token the first just rotated. Reuse detection then revoked the whole family and signed every process out: production logged 35 rejected /oauth/token requests within minutes on 2026-10-19.

The owner approved this trade-off:

• Grace window. A refresh token rotated within the last 60 seconds is admitted again, but only when the request comes from the same client, for the same resource, while the token is unexpired and its family still has a live refresh token. That sibling gets its own pair in the family, and the rotation time is not moved, so the window cannot be extended. Okta and Auth0 offer the same option, as a "grace period" or "reuse interval".
• Still reuse, and still revokes the family: any reuse after the window, of an expired rotated token, of a rotation dated in the future (clock stepped back), or against a revoked family (reuse, user revocation, suspension, retired scope).
• Access tokens last 1 hour instead of 15 minutes. Every request checks them against the database, so revocation stays immediate, and refreshes, and the chance of such races, fall fourfold.
• Docs: docs/authentication.md updated.

Tests:

• a sibling within the window gets distinct working credentials;
• the window cannot be extended, and reuse after it revokes all descendants;
• another client is refused;
• a revoked family cannot be revived;
• a clock step back is treated as reuse;
• an expired replay within the window is treated as reuse;
• the existing reuse, cleanup and HTTP refresh tests are adjusted for the window.

Verification:

• just check passes.
• Three Codex adversarial security review rounds. Round one found the clock-step-back case and round two found the expiry-crossing case; both are fixed with regression tests. Round three approved.

https://claude.ai/code/session_018HfyEXHyGD1utmKF4CQtyQ