diff --git a/src/lib/oauth/utils/codexAuthImport.ts b/src/lib/oauth/utils/codexAuthImport.ts
index 54c7a98d02..a27d97b126 100644
--- a/src/lib/oauth/utils/codexAuthImport.ts
+++ b/src/lib/oauth/utils/codexAuthImport.ts
@@ -56,18 +56,6 @@ function extractCodexAccountId(
 
 // ──── Public types ────────────────────────────────────────────────────────────
 
-export interface CodexAuthFileInput {
-  auth_mode?: unknown;
-  OPENAI_API_KEY?: unknown;
-  tokens?: {
-    id_token?: unknown;
-    access_token?: unknown;
-    refresh_token?: unknown;
-    account_id?: unknown;
-  };
-  last_refresh?: unknown;
-}
-
 export interface ParsedCodexAuth {
   idToken: string;
   accessToken: string;
diff --git a/tests/unit/token-refresh-race-comprehensive.test.ts b/tests/unit/token-refresh-race-comprehensive.test.ts
index ec85c91383..070cd85601 100644
--- a/tests/unit/token-refresh-race-comprehensive.test.ts
+++ b/tests/unit/token-refresh-race-comprehensive.test.ts
@@ -87,6 +87,13 @@ test("Fix C reverted: codexAuthImport does NOT refresh tokens on import (avoids
   );
 });
 
+test("codexAuthImport public surface keeps only consumed auth import types", async () => {
+  const src = await read("src/lib/oauth/utils/codexAuthImport.ts");
+  assert.doesNotMatch(src, /export interface CodexAuthFileInput\b/);
+  assert.match(src, /export interface ParsedCodexAuth\b/);
+  assert.match(src, /export interface CreateConnectionOptions\b/);
+});
+
 test("Fix D: staleness fallback returns absolute expiresAt, not raw expiresIn", async () => {
   const src = await read("open-sse/services/tokenRefresh.ts");
   // Locate the actual return statement, not the JSDoc mention.