Exact error
Match the message before using the fix
SEC_E_NO_CREDENTIALS (0x8009030e)schannel: AcquireCredentialsHandle failed: SEC_E_NO_CREDENTIALSAuthentication failed, see inner exceptionQuick answer
Start here
First prove this is the sandbox-specific Schannel branch: the same approved HTTPS target works outside Codex, raw connectivity works inside, and a non-Schannel client such as Python works inside while PowerShell or `curl.exe` returns `SEC_E_NO_CREDENTIALS`. There is no confirmed permanent fix. Using a non-Schannel client can unblock one task, but manually logging on as Codex sandbox accounts or changing profile permissions is only an investigation path, not a safe universal repair.
Diagnosis
Why it happens
- The exact failure comes from the Windows Schannel/SSPI credential acquisition path, not necessarily from DNS or TCP connectivity.
- The report points to an interaction among the restricted sandbox token, Windows user-profile state, and Schannel, but the root cause is not maintainer-confirmed.
- Dedicated Codex sandbox accounts succeeded after manual profile creation, yet the actively failing shell appeared to run as the restricted real user; that prevents treating profile initialization as a proven fix.
Safest first
Fixes, in order
Separate Schannel failure from a general network outage
Applies when: When PowerShell or curl reports `SEC_E_NO_CREDENTIALS` inside Codex
The source report used inside/outside and Schannel/non-Schannel controls to isolate the Windows TLS stack.
- Choose one organization-approved HTTPS endpoint that returns no sensitive data.
- Test it with PowerShell or `curl.exe` inside the normal Codex sandbox.
- Test the same endpoint outside Codex with the same Windows account.
- Inside Codex, compare with a Python HTTPS request if Python is already available.
Expected: Only Schannel-based requests inside the sandbox fail with `SEC_E_NO_CREDENTIALS`; the comparison paths succeed.
Use an existing non-Schannel client for the narrow task
Applies when: Temporary use when Python HTTPS works in the same sandbox and the command can be safely expressed there
Python HTTPS succeeded in the original reproduction, which can unblock a specific read without changing Windows security state.
- Use only a client already approved and installed in the environment.
- Send the minimum required request without copying credentials into command history.
- Keep certificate verification enabled.
- Return to the original tool after a vendor fix rather than treating the substitution as a Schannel repair.
Expected: The narrow HTTPS operation succeeds while the PowerShell/curl Schannel failure remains honestly documented.
Escalate the exact token/profile evidence
Applies when: When the controlled comparison matches the open issue
Windows account and token changes can weaken isolation and are not justified by the current evidence.
- Record Codex version, Windows build, shell, curl TLS backend, and the exact inner Win32 code.
- Record whether Python HTTPS and outside-sandbox PowerShell succeed.
- Do not log on interactively as `CodexSandboxOnline` or `CodexSandboxOffline` on a managed machine without administrator approval.
- Track the linked issue for a confirmed implementation fix.
Expected: The report distinguishes a Schannel sandbox defect from firewall, proxy, DNS, and certificate failures without changing security policy.
Verification
Prove the fix worked
- A real fix requires PowerShell or Schannel curl to work inside the normal sandbox.
- Repeat the test in a new Codex session with certificate verification enabled.
- Confirm no permanent sandbox bypass, broad ACL change, or alternate Windows account is required.
Escalation
If it still fails
- If Python also fails, investigate DNS, proxy, firewall, and certificate trust instead of this Schannel-only branch.
- If the error appears outside Codex, diagnose Windows Schannel or enterprise policy separately.
- Do not disable TLS verification or expose tokens to prove connectivity.
Scope
Environment and version notes
- The source report used Windows 11 build 26200, PowerShell 7.5.5, and Schannel curl 8.18.0.
- The issue remained open on August 20, 2026. The npm registry listed Codex CLI 0.148.0, with no confirmed fixed version for this error.
- Sources rechecked August 20, 2026.
Evidence
Sources
Source labels describe the evidence available on the checked date. A closed issue is not automatically a shipped fix.