feat: add explicit AgentIdentity auth mode by efrazer-oai · Pull Request #18785 · openai/codex

efrazer-oai · 2026-04-21T01:41:33Z

Summary

This PR adds CodexAuth::AgentIdentity as an explicit auth mode.

An AgentIdentity auth record is a standalone auth.json mode. When AuthManager::auth().await loads that mode, it registers one process-scoped task and stores it in runtime-only state on the auth value. Header creation stays synchronous after that because the task is initialized before callers receive the auth object.

This PR also removes the old feature flag path. AgentIdentity is selected by explicit auth mode, not by a hidden flag or lazy mutation of ChatGPT auth records.

Reference old stack: https://github.com/openai/codex/pull/17387/changes

Design Decisions

AgentIdentity is a real auth enum variant because it can be the only credential in auth.json.
The process task is ephemeral runtime state. It is not serialized and is not stored in rollout/session data.
Account/user metadata needed by existing Codex backend checks lives on the AgentIdentity record for now.
is_chatgpt_auth() remains token-specific.
uses_codex_backend() is the broader predicate for ChatGPT-token auth and AgentIdentity auth.

Stack

fix: fully revert agent identity runtime wiring #18757: full revert
refactor: add agent identity crate #18871: isolated Agent Identity crate
This PR: explicit AgentIdentity auth mode and startup task allocation
refactor: route Codex auth through AuthProvider #18811: migrate Codex backend auth callsites through AuthProvider
feat: load AgentIdentity from JWT env #18904: accept AgentIdentity JWTs and load CODEX_AGENT_IDENTITY

Testing

Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/login/src/auth/manager.rs

Lines 1571 to 1572 in 0b61c82

    
           if !auth.is_chatgpt_auth() { 
        
               return None;

Return AgentIdentity auth header from ChatGPT auth helper

chatgpt_authorization_header_for_auth immediately returns None when is_chatgpt_auth() is false, which excludes CodexAuth::AgentIdentity. Existing backend callers still use this helper for authorization, so Agent Identity sessions fail to attach any auth header and behave as unauthenticated.

codex/codex-rs/core/src/client.rs

Line 677 in 0b61c82

if self.state.provider.info().requires_openai_auth && auth.is_chatgpt_auth() =>

Route AgentIdentity through auth-manager auth path in client setup

current_client_setup only uses auth-manager header injection when auth.is_chatgpt_auth() is true. AgentIdentity fails that check, so execution falls back to provider.api_auth(), which calls get_token() and errors for Agent Identity. Result: normal model requests fail before dispatch when AgentIdentity is active.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

efrazer-oai · 2026-04-21T07:56:41Z

Codex review comments resolved.

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/models-manager/src/manager.rs

Line 415 in b23a44f

    
           if auth_mode != Some(AuthMode::Chatgpt) && !self.provider.info().has_command_auth() {

Treat AgentIdentity as ChatGPT auth for model refresh

refresh_available_models exits unless auth_mode == Some(AuthMode::Chatgpt). After introducing explicit AgentIdentity, authenticated AgentIdentity users take this early-return path and skip remote model-catalog refresh (unless command auth is configured), leaving stale or missing model availability.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

efrazer-oai · 2026-04-21T15:39:35Z

Codex r

💡 Codex Review

codex/codex-rs/models-manager/src/manager.rs

Line 415 in b23a44f

if auth_mode != Some(AuthMode::Chatgpt) && !self.provider.info().has_command_auth() {

Treat AgentIdentity as ChatGPT auth for model refresh
refresh_available_models exits unless auth_mode == Some(AuthMode::Chatgpt). After introducing explicit AgentIdentity, authenticated AgentIdentity users take this early-return path and skip remote model-catalog refresh (unless command auth is configured), leaving stale or missing model availability.

ℹ️ About Codex in GitHub

PR 3 is responsible for this fix as it does a broader migration of is_chatgpt_auth callsites

pakrym-oai · 2026-04-21T15:41:49Z

    Ok(BASE64_STANDARD.encode(signing_key.sign(payload.as_bytes()).to_bytes()))
 }

+pub fn register_agent_task_blocking(


should this be async/

Intentionally kept sync here as we need the task on startup and want to block on it, some of the alternatives are in PR description. But lmk if any of the other alternatives (e.g. making this async, propagating upwards into making AuthManager::new async) work better; i don't have a strong opinion and the choice was hard for me to reason about fully

Can we resolve when .auth is called on AuthManager?

pakrym-oai · 2026-04-21T15:48:44Z

            auth_mode: auth_mode.map(|mode| match mode {
                AuthMode::ApiKey => "ApiKey",
-                AuthMode::Chatgpt | AuthMode::ChatgptAuthTokens => "Chatgpt",
+                AuthMode::Chatgpt | AuthMode::ChatgptAuthTokens | AuthMode::AgentIdentity => {


maybe worth mentioning agent identity

## Summary This PR fully reverts the previously merged Agent Identity runtime integration from the old stack: https://github.com/openai/codex/pull/17387/changes It removes the Codex-side task lifecycle wiring, rollout/session persistence, feature flag plumbing, lazy `auth.json` mutation, background task auth paths, and request callsite changes introduced by that stack. This leaves the repo in a clean pre-AgentIdentity integration state so the follow-up PRs can reintroduce the pieces in smaller reviewable layers. ## Stack 1. This PR: full revert 2. #18871: move Agent Identity business logic into a crate 3. #18785: add explicit AgentIdentity auth mode and startup task allocation 4. #18811: migrate auth callsites through AuthProvider ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

pakrym-oai · 2026-04-21T22:48:53Z

            config.cli_auth_credentials_store_mode(),
        );
        auth_manager.set_forced_chatgpt_workspace_id(config.forced_chatgpt_workspace_id());
+        auth_manager.set_chatgpt_backend_base_url(Some(config.chatgpt_base_url()));


Why don't we construct the manager with correct values and avoid RwLock?

pakrym-oai · 2026-04-21T22:50:42Z

+        self.chatgpt_authorization_header_for_auth(&auth).await
+    }
+
+    pub async fn chatgpt_authorization_header_for_auth(


do we still need this? I thought we are doing headers via AuthProvider ?

Removed -> these were unused after PR after this, but no point having them here.

pakrym-oai · 2026-04-21T22:51:08Z

+        }
+    }
+
+    pub fn chatgpt_base_url(&self) -> Option<String> {


we shouldn't expose this publicly

pakrym-oai · 2026-04-21T22:51:20Z

+    /// Sets the ChatGPT backend URL override for future auth runtime initialization.
+    /// Passing `None` clears the override and returns future initialization to the
+    /// default backend URL.
+    pub fn set_chatgpt_backend_base_url(&self, chatgpt_base_url: Option<String>) {


should just be set in ctor

pakrym-oai · 2026-04-21T23:00:05Z

+        Self::chatgpt_bearer_token_for_auth(auth).map(|token| format!("Bearer {token}"))
+    }
+
+    pub fn subscribe_auth_state(&self) -> watch::Receiver<()> {


Do we need this subscribe?

No, was used for syncing chatgpt_url but we're passing in top level now, removed.

pakrym-oai · 2026-04-21T23:01:06Z

 impl PartialEq for CodexAuth {
    fn eq(&self, other: &Self) -> bool {
-        self.api_auth_mode() == other.api_auth_mode()
+        match (self, other) {


do we care about this implemenation?

efrazer-oai force-pushed the dev/efrazer/agent-identity-minimal-auth branch from 5259e6a to 375d41a Compare April 21, 2026 03:08

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch 2 times, most recently from 1e23097 to 97f8580 Compare April 21, 2026 03:29

efrazer-oai changed the title ~~refactor: add explicit agent identity auth mode~~ Add explicit AgentIdentity auth mode Apr 21, 2026

efrazer-oai changed the base branch from dev/efrazer/agent-identity-minimal-auth to dev/efrazer/agent-identity-crate April 21, 2026 03:29

This was referenced Apr 21, 2026

refactor: simplify agent identity auth #18758

Closed

fix: fully revert agent identity runtime wiring #18757

Merged

efrazer-oai force-pushed the dev/efrazer/agent-identity-crate branch from 117d4ac to b647fd7 Compare April 21, 2026 04:11

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch 2 times, most recently from e8525b0 to 742bf2d Compare April 21, 2026 04:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-crate branch from b647fd7 to 5acde03 Compare April 21, 2026 04:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 742bf2d to 86413e2 Compare April 21, 2026 05:24

efrazer-oai mentioned this pull request Apr 21, 2026

refactor: route Codex auth through AuthProvider #18811

Open

efrazer-oai assigned pakrym-oai, shijie-oai and adrian-openai Apr 21, 2026

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 86413e2 to 0b61c82 Compare April 21, 2026 05:50

efrazer-oai marked this pull request as ready for review April 21, 2026 05:50

efrazer-oai requested a review from a team as a code owner April 21, 2026 05:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-crate branch from 5acde03 to 342ad35 Compare April 21, 2026 05:53

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0b61c82 to 52e547c Compare April 21, 2026 05:53

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/manager.rs

efrazer-oai marked this pull request as draft April 21, 2026 07:13

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch 2 times, most recently from b718d3e to b23a44f Compare April 21, 2026 07:44

efrazer-oai marked this pull request as ready for review April 21, 2026 08:01

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/manager.rs

Comment thread codex-rs/login/src/auth/manager.rs Outdated

efrazer-oai requested review from pakrym-oai and shijie-oai April 21, 2026 15:32

pakrym-oai reviewed Apr 21, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-crate branch from 342ad35 to 517af31 Compare April 21, 2026 19:16

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from b23a44f to 4c2b315 Compare April 21, 2026 19:16

efrazer-oai mentioned this pull request Apr 21, 2026

refactor: add agent identity crate #18871

Open

efrazer-oai changed the base branch from dev/efrazer/agent-identity-crate to dev/efrazer/agent-identity-lib April 21, 2026 19:17

efrazer-oai changed the title ~~Add explicit AgentIdentity auth mode~~ feat: add explicit AgentIdentity auth mode Apr 21, 2026

efrazer-oai force-pushed the dev/efrazer/agent-identity-lib branch from efedf63 to e02b5c8 Compare April 21, 2026 19:24

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 4c2b315 to be0d99c Compare April 21, 2026 19:24

efrazer-oai force-pushed the dev/efrazer/agent-identity-lib branch from e02b5c8 to 570e766 Compare April 21, 2026 20:57

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from be0d99c to 0881c58 Compare April 21, 2026 20:57

efrazer-oai force-pushed the dev/efrazer/agent-identity-lib branch from 570e766 to 5f85536 Compare April 21, 2026 21:03

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0881c58 to 0f90a02 Compare April 21, 2026 21:03

feat: add agent identity auth mode

71521cf

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0f90a02 to 8bca584 Compare April 21, 2026 21:36

efrazer-oai force-pushed the dev/efrazer/agent-identity-lib branch from 5f85536 to 52fc527 Compare April 21, 2026 21:36

pakrym-oai reviewed Apr 21, 2026

View reviewed changes

efrazer-oai mentioned this pull request Apr 21, 2026

feat: load AgentIdentity from JWT env #18904

Open

pakrym-oai reviewed Apr 21, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 8bca584 to 9679412 Compare April 21, 2026 23:15

efrazer-oai added 2 commits April 21, 2026 16:45

fix: plumb ChatGPT backend URL into auth manager

46d3e99

refactor: remove redundant agent key serde rename

c9e8046

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 9679412 to c9e8046 Compare April 21, 2026 23:47

Conversation

efrazer-oai commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Design Decisions

Stack

Testing

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

efrazer-oai commented Apr 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

efrazer-oai commented Apr 21, 2026

💡 Codex Review

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

efrazer-oai commented Apr 21, 2026 •

edited

Loading