refactor: route Codex auth through AuthProvider by efrazer-oai · Pull Request #18811 · openai/codex

efrazer-oai · 2026-04-21T05:24:39Z

Summary

This PR moves Codex backend request authentication from direct bearer-token handling to AuthProvider.

The new codex-auth-provider crate defines the shared request-auth trait. CodexAuth::provider() returns a provider that can apply all headers needed for the selected auth mode.

This lets ChatGPT token auth and AgentIdentity auth share the same callsite path:

ChatGPT token auth applies bearer auth plus account/FedRAMP headers where needed.
AgentIdentity auth applies AgentAssertion plus account/FedRAMP headers where needed.

Reference old stack: https://github.com/openai/codex/pull/17387/changes

Callsite Migration

Area	Change
backend-client	accepts an `AuthProvider` instead of a raw token/header
chatgpt client/connectors	applies auth through `CodexAuth::provider()`
cloud tasks	keeps Codex-backend gating, applies auth through provider
cloud requirements	uses Codex-backend auth checks and provider headers
app-server remote control	applies provider headers for backend calls
MCP Apps/connectors	gates on `uses_codex_backend()` and keys caches from generic account getters
model refresh	treats AgentIdentity as Codex-backend auth
OpenAI file upload path	rejects non-Codex-backend auth before applying headers
core client setup	keeps model-provider auth flow and allows AgentIdentity through provider-backed OpenAI auth

Stack

fix: fully revert agent identity runtime wiring #18757: full revert
refactor: add agent identity crate #18871: isolated Agent Identity crate
feat: add explicit AgentIdentity auth mode #18785: explicit AgentIdentity auth mode and startup task allocation
This PR: migrate Codex backend auth callsites through AuthProvider
feat: load AgentIdentity from JWT login/env #18904: accept AgentIdentity JWTs and load CODEX_AGENT_IDENTITY

Testing

Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af22d58d06

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/chatgpt/src/connectors.rs

Lines 27 to 31 in 690d32a

    
           let auth_manager = AuthManager::shared( 
        
               config.codex_home.to_path_buf(), 
        
               /*enable_codex_api_key_env*/ false, 
        
               config.cli_auth_credentials_store_mode, 
        
           );

Use config-backed auth manager when checking Apps auth

apps_enabled() now treats AgentIdentity as valid (uses_codex_backend), but it still builds auth with AuthManager::shared(...), which does not pass config.chatgpt_base_url. AgentIdentity runtime init can then target the default backend and fail in non-default deployments, causing this early gate to return false and skip connectors despite valid auth.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pakrym-oai · 2026-04-22T01:33:02Z

-    let token_data =
-        get_chatgpt_token_data().ok_or_else(|| anyhow::anyhow!("ChatGPT token not available"))?;
-    let cache_key = all_connectors_cache_key(config, &token_data);
+    let auth_manager =


we added a bit of boilerplate by removing init_chatgpt_token_from_auth. anyting worth doing?

I added a different type of helper for this to avoid repetition; i think reasoning about the Auth object is easier than the OnceLock we had for auth data which felt a bit hidden.

pakrym-oai · 2026-04-22T01:41:56Z

+                    .map_err(std::io::Error::other)
+                })
+            }
+            CodexAuth::ApiKey(_) => self.auth.api_key().map_or_else(


why does this partially reimplement bearer provider? can we add a separate provider for model identity and reuse bearer when appropriate/

pakrym-oai · 2026-04-22T01:42:36Z

        })
    }

+    pub fn is_workspace_account(&self) -> bool {


don't we already have this logic somewhere?

Extracted it out into a helper under plan_type

pakrym-oai · 2026-04-22T01:43:09Z

        &self.record
    }

+    pub fn process_task_id(&self) -> Option<&str> {


both pub field and pub method?

Fixed, only pub getter now

## Summary This PR adds `codex-agent-identity` as an isolated crate for Agent Identity business logic. The crate owns: - AgentAssertion construction. - Agent task registration. - private-key assertion signing. - bounded blocking HTTP for task registration. It does not wire AgentIdentity into `auth.json`, `AuthManager`, rollout state, or request callsites. That integration happens in later PRs. Reference old stack: https://github.com/openai/codex/pull/17387/changes ## Stack 1. #18757: full revert 2. This PR: isolated Agent Identity crate 3. #18785: explicit AgentIdentity auth mode and startup task allocation 4. #18811: migrate Codex backend auth callsites through AuthProvider 5. #18904: accept AgentIdentity JWTs and load `CODEX_AGENT_IDENTITY` ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

## Summary This PR adds `CodexAuth::AgentIdentity` as an explicit auth mode. An AgentIdentity auth record is a standalone `auth.json` mode. When `AuthManager::auth().await` loads that mode, it registers one process-scoped task and stores it in runtime-only state on the auth value. Header creation stays synchronous after that because the task is initialized before callers receive the auth object. This PR also removes the old feature flag path. AgentIdentity is selected by explicit auth mode, not by a hidden flag or lazy mutation of ChatGPT auth records. Reference old stack: https://github.com/openai/codex/pull/17387/changes ## Design Decisions - AgentIdentity is a real auth enum variant because it can be the only credential in `auth.json`. - The process task is ephemeral runtime state. It is not serialized and is not stored in rollout/session data. - Account/user metadata needed by existing Codex backend checks lives on the AgentIdentity record for now. - `is_chatgpt_auth()` remains token-specific. - `uses_codex_backend()` is the broader predicate for ChatGPT-token auth and AgentIdentity auth. ## Stack 1. #18757: full revert 2. #18871: isolated Agent Identity crate 3. This PR: explicit AgentIdentity auth mode and startup task allocation 4. #18811: migrate Codex backend auth callsites through AuthProvider 5. #18904: accept AgentIdentity JWTs and load `CODEX_AGENT_IDENTITY` ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

pakrym-oai · 2026-04-22T16:40:32Z

+        }
+    }
+
+    pub fn empty() -> Self {


why would we ever construct empty?

pakrym-oai · 2026-04-22T16:41:43Z

-                retry_suffix_after_or(self.resets_at.as_ref())
-            ),
-            Some(PlanType::Known(
+            Some(PlanType::Known(plan)) => match plan {


let's not churn this logic unless needed.

pakrym-oai · 2026-04-22T16:42:12Z

-                | Self::Enterprise
-                | Self::Edu
-        )
+        self.is_team_like()


do we need to change this?

pakrym-oai · 2026-04-22T16:44:34Z

 }

 impl KnownPlan {
+    pub fn is_team_like(self) -> bool {


why do we have these methods in so many places? on KnownPlan and on PlanType

## Summary This PR fully reverts the previously merged Agent Identity runtime integration from the old stack: https://github.com/openai/codex/pull/17387/changes It removes the Codex-side task lifecycle wiring, rollout/session persistence, feature flag plumbing, lazy `auth.json` mutation, background task auth paths, and request callsite changes introduced by that stack. This leaves the repo in a clean pre-AgentIdentity integration state so the follow-up PRs can reintroduce the pieces in smaller reviewable layers. ## Stack 1. This PR: full revert 2. openai#18871: move Agent Identity business logic into a crate 3. openai#18785: add explicit AgentIdentity auth mode and startup task allocation 4. openai#18811: migrate auth callsites through AuthProvider ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

efrazer-oai mentioned this pull request Apr 21, 2026

feat: add explicit AgentIdentity auth mode #18785

Merged

efrazer-oai assigned pakrym-oai and shijie-oai Apr 21, 2026

efrazer-oai marked this pull request as ready for review April 21, 2026 05:49

efrazer-oai requested a review from a team as a code owner April 21, 2026 05:49

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from af22d58 to d21eaed Compare April 21, 2026 05:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 86413e2 to 0b61c82 Compare April 21, 2026 05:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from d21eaed to 52b5ad3 Compare April 21, 2026 05:53

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0b61c82 to 52e547c Compare April 21, 2026 05:53

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread codex-rs/core/src/mcp_openai_file.rs Outdated

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from 52b5ad3 to b51b093 Compare April 21, 2026 07:12

efrazer-oai marked this pull request as draft April 21, 2026 07:13

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from b4f801e to b718d3e Compare April 21, 2026 07:22

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from b51b093 to f5befea Compare April 21, 2026 07:22

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from b718d3e to b23a44f Compare April 21, 2026 07:44

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from f5befea to 690d32a Compare April 21, 2026 07:44

efrazer-oai marked this pull request as ready for review April 21, 2026 08:00

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread codex-rs/codex-mcp/src/mcp/mod.rs

efrazer-oai requested review from adrian-openai, pakrym-oai and shijie-oai April 21, 2026 15:33

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from b23a44f to 4c2b315 Compare April 21, 2026 19:16

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from efc466e to 37f3339 Compare April 21, 2026 19:16

This was referenced Apr 21, 2026

refactor: add agent identity crate #18871

Merged

fix: fully revert agent identity runtime wiring #18757

Merged

efrazer-oai changed the title ~~Migrate Codex backend auth header callers~~ refactor: route Codex auth through AuthProvider Apr 21, 2026

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 4c2b315 to be0d99c Compare April 21, 2026 19:24

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from 37f3339 to dc19ee2 Compare April 21, 2026 19:24

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from be0d99c to 0881c58 Compare April 21, 2026 20:57

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from dc19ee2 to 6784881 Compare April 21, 2026 20:57

pakrym-oai reviewed Apr 22, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch 2 times, most recently from df5a2df to ed51cb2 Compare April 22, 2026 01:41

pakrym-oai reviewed Apr 22, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from ed51cb2 to 40daf07 Compare April 22, 2026 02:53

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from 40daf07 to 06285d7 Compare April 22, 2026 03:14

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from ce246ec to cb93ab0 Compare April 22, 2026 03:32

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from 06285d7 to b7bde9c Compare April 22, 2026 03:32

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from cb93ab0 to 316a875 Compare April 22, 2026 05:00

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from b7bde9c to a457bb3 Compare April 22, 2026 05:01

Base automatically changed from dev/efrazer/agent-identity-auth-runtime to main April 22, 2026 05:33

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from a457bb3 to 6c03831 Compare April 22, 2026 05:36

efrazer-oai requested a review from pakrym-oai April 22, 2026 15:00

pakrym-oai reviewed Apr 22, 2026

View reviewed changes

pakrym-oai approved these changes Apr 22, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch 4 times, most recently from d339b11 to ece4453 Compare April 23, 2026 01:54

efrazer-oai added 3 commits April 23, 2026 15:26

refactor: route codex auth through providers

3d71b6c

refactor: keep authorization headers in provider

96e52ec

fix: refresh codex auth providers per request

72fe598

	let auth_manager = AuthManager::shared(
	config.codex_home.to_path_buf(),
	/enable_codex_api_key_env/ false,
	config.cli_auth_credentials_store_mode,
	);

Conversation

efrazer-oai commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Callsite Migration

Stack

Testing

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

efrazer-oai commented Apr 21, 2026 •

edited

Loading