Idea: API-based authorization flow for accounts when SMS verification is unavailable

[kingofligh]

Hi! I would like to suggest an API-based authorization flow for accounts.

The current account authorization can be problematic when SMS verification is required. For example, if the account asks for SMS confirmation, but the original SIM card is no longer available, it becomes impossible to complete the normal browser-based authorization flow.

I tested a similar approach on Windows with Codex Beta: I created a secret key and successfully authorized through the API. Because of that, I think codex-lb could benefit from an alternative API authorization method.

Possible idea:

• Add account via API secret key.
• Validate the key/account access.
• Add it to the codex-lb account pool.
• Mark the account as API-authorized in the dashboard.

This would help a lot for VPS/Docker/headless deployments and for cases where SMS verification is unavailable.

Security-wise, the feature could be protected by the existing admin authentication, store secrets securely, avoid exposing raw keys after saving, and optionally be disabled through an environment variable.

Thanks for the project!

[chenxiang0114]

Could you describe in detail the process of generating the API key on the Windows side? Or do you have any related GitHub projects? I'm not really sure how this solution works