Replacing auth.json while a Codex turn is running is unsafe because one process can still be using the old identity while durable files now describe another. That split can affect the in-flight request, account-bound transports, transition journal, and any parked usage-limit recovery. Use codex marathon switch <alias-or-id> instead. The supported switch waits for an idle boundary, verifies the target identity, and records uncertainty rather than guessing that a file change succeeded.

This is a safety explanation, not a recommendation to edit credentials by hand. The CodexMarathon home page describes the native account workflow, and how to switch accounts without losing your conversation shows the supported command path.

A file is not the whole authentication state

It is tempting to think of authentication as one JSON file: replace the file, and the next request uses the other account. A running Codex process has more state than that file. Native Codex owns the active identity, authentication reload, account-bound transport invalidation, conversation thread, and recovery continuation. Marathon owns policy and durable account metadata around those native decisions.

The file therefore cannot be treated as a universal switch. A process may have already loaded the source credential, opened an account-bound transport, or started a turn. Editing the file changes what a later reload might see; it does not retroactively change work already in flight or tell every component that a transition happened.

The risk is not limited to an error message. The source identity could be recorded in one place while a target snapshot appears in another. A transition could look committed from a rename even though native Codex never acknowledged the new identity. A recovery continuation could then be released against the wrong assumption. The safe design makes those states explicit and verifies them together.

What can go wrong during a live turn

Consider a simple timeline:

  1. Codex starts a turn under account personal.
  2. A tool call or model response is still account-bound.
  3. Another shell replaces auth.json with a snapshot for work.
  4. The running process continues with loaded personal state, or reloads work at an uncontrolled point.
  5. A retry, transport close, or recovery path sees a different identity than the original turn.

The exact result depends on timing, but that uncertainty is the point. The request could fail, a transport could be invalidated unexpectedly, or durable metadata could disagree with the native identity. If the process dies after the write but before an acknowledgement, there is no trustworthy evidence that a switch committed.

Usage-limit recovery adds a second hazard. When native Codex reports UsageLimitExceeded, it parks the existing recovery turn. If an external file edit changes identity while the recovery is parked, releasing it could use an unverified target—or a caller might submit a manually copied continuation and create a duplicate. CodexMarathon instead keeps one transition ID and recovery ID, verifies the target, and resumes the existing work exactly once.

Follow the safe-boundary command

Prepare managed profiles and request the switch through the native command surface:

codex marathon status
codex marathon accounts
codex marathon switch work
codex marathon status

Marathon waits until all account-bound work is idle. It rechecks the source identity immediately before deployment, validates and persists the target profile atomically, and asks Codex to reload native authentication. Native Codex invalidates account-bound transports and reads back the target identity. The transition commits only when the target, expected generation, and thread agree.

An active model response, tool call, or subagent turn is not changed halfway through. If the request is rejected, the target is not adopted. If persistence, reload, or acknowledgement is lost, the state is recorded as uncertain and remains available for reconciliation. That is slower than a file copy, but it is evidence you can reason about.

Inside an interactive session, use:

/marathon status
/marathon switch work
/marathon status

Wait for a committed result before starting new account-bound work. Do not launch another switch merely because the first command has not produced a clean acknowledgement.

Why backup import does not edit auth.json

The encrypted backup workflow makes the same separation explicit. Exported archives contain selected stable account IDs, aliases, and opaque credential snapshots. They do not contain the active marker, quota observations, scheduler state, event history, source path, or machine metadata.

On import, CodexMarathon decrypts and validates the complete archive before changing state, stages credentials under fresh vault references, and commits the registry in one atomic update. Imported profiles remain inactive. Import preserves the destination’s active account, enabled setting, active native credentials, and auth.json; it never silently replaces the identity currently serving a turn.

After a successful import, choose the intended profile explicitly:

codex marathon backup import accounts.cmbackup --dry-run
codex marathon backup import accounts.cmbackup --yes
codex marathon accounts
codex marathon switch work

Use the appropriate passphrase-file options for unattended operation, as documented in the multiple-account workflow. Keep the archive and passphrase separate, and never paste either into a conversation or public issue.

Diagnose an uncertain state safely

If someone already edited auth.json during a turn, stop starting new account-bound work. Run read-only checks:

codex marathon status
codex marathon accounts

Look for an active alias, transition status, credential health, and any uncertainty that needs reconciliation. Do not infer a committed switch from the file’s modification time, a successful cp, or a process exit. If native Codex reports an identity mismatch, follow its recovery path and preserve the transition evidence rather than overwriting more files.

When in doubt, let native Codex remain authoritative. Marathon’s contract is intentionally conservative: a failed transition is rejected, a lost acknowledgement is uncertain, and a parked continuation stays parked until the target identity is verified. The automatic quota-recovery guide explains why no eligible account means waiting rather than forcing a file change.

Keep credentials opaque

Hand-editing also increases the chance of exposing a snapshot through shell history, backups, editor swap files, process diagnostics, or a copied support log. CodexMarathon keeps credential snapshots opaque to accountd, status output, logs, and transition records. Supported login and backup flows keep secret input in native or owner-private state.

Only managed ChatGPT authentication profiles are switchable. API keys, external bearer authentication, workload identity, and other unsupported modes are rejected for Marathon switching. That boundary prevents a generic file replacement from becoming an unreviewed provider-authentication mechanism.

A safe account change is therefore a coordinated native transition, not a file operation: wait for idle work, persist and reload through the supported path, verify the identity, and resume only the existing continuation. That is the difference between changing a filename and changing an account with evidence.