refactor: route Codex auth through AuthProvider by efrazer-oai · Pull Request #18811 · openai/codex

efrazer-oai · 2026-04-21T05:24:39Z

Summary

This PR moves Codex backend request authentication from direct bearer-token handling to AuthProvider.

The new codex-auth-provider crate defines the shared request-auth trait. CodexAuth::provider() returns a provider that can apply all headers needed for the selected auth mode.

This lets ChatGPT token auth and AgentIdentity auth share the same callsite path:

ChatGPT token auth applies bearer auth plus account/FedRAMP headers where needed.
AgentIdentity auth applies AgentAssertion plus account/FedRAMP headers where needed.

Reference old stack: https://github.com/openai/codex/pull/17387/changes

Callsite Migration

Area	Change
backend-client	accepts an `AuthProvider` instead of a raw token/header
chatgpt client/connectors	applies auth through `CodexAuth::provider()`
cloud tasks	keeps Codex-backend gating, applies auth through provider
cloud requirements	uses Codex-backend auth checks and provider headers
app-server remote control	applies provider headers for backend calls
MCP Apps/connectors	gates on `uses_codex_backend()` and keys caches from generic account getters
model refresh	treats AgentIdentity as Codex-backend auth
OpenAI file upload path	rejects non-Codex-backend auth before applying headers
core client setup	keeps model-provider auth flow and allows AgentIdentity through provider-backed OpenAI auth

Stack

fix: fully revert agent identity runtime wiring #18757: full revert
refactor: add agent identity crate #18871: isolated Agent Identity crate
feat: add explicit AgentIdentity auth mode #18785: explicit AgentIdentity auth mode and startup task allocation
This PR: migrate Codex backend auth callsites through AuthProvider
feat: load AgentIdentity from JWT env #18904: accept AgentIdentity JWTs and load CODEX_AGENT_IDENTITY

Testing

Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af22d58d06

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/chatgpt/src/connectors.rs

Lines 27 to 31 in 690d32a

    
           let auth_manager = AuthManager::shared( 
        
               config.codex_home.to_path_buf(), 
        
               /*enable_codex_api_key_env*/ false, 
        
               config.cli_auth_credentials_store_mode, 
        
           );

Use config-backed auth manager when checking Apps auth

apps_enabled() now treats AgentIdentity as valid (uses_codex_backend), but it still builds auth with AuthManager::shared(...), which does not pass config.chatgpt_base_url. AgentIdentity runtime init can then target the default backend and fail in non-default deployments, causing this early gate to return false and skip connectors despite valid auth.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-21T08:16:44Z

    authorization_header_value: Option<&str>,
 ) -> HashMap<String, McpServerConfig> {
-    if config.apps_enabled && auth.is_some_and(CodexAuth::is_chatgpt_auth) {
+    if config.apps_enabled && auth.is_some_and(CodexAuth::uses_codex_backend) {


Key Codex Apps MCP cache by backend auth identity

After widening the apps gate to CodexAuth::uses_codex_backend, AgentIdentity now enters this path. However, cache identity is still derived from codex_apps_tools_cache_key() using get_token_data() (in mcp_connection_manager.rs), which is empty for AgentIdentity. That collapses cache keys to the same {None,None,false} value and can serve another account’s cached Apps tool list.

Useful? React with 👍 / 👎.

## Summary This PR fully reverts the previously merged Agent Identity runtime integration from the old stack: https://github.com/openai/codex/pull/17387/changes It removes the Codex-side task lifecycle wiring, rollout/session persistence, feature flag plumbing, lazy `auth.json` mutation, background task auth paths, and request callsite changes introduced by that stack. This leaves the repo in a clean pre-AgentIdentity integration state so the follow-up PRs can reintroduce the pieces in smaller reviewable layers. ## Stack 1. This PR: full revert 2. #18871: move Agent Identity business logic into a crate 3. #18785: add explicit AgentIdentity auth mode and startup task allocation 4. #18811: migrate auth callsites through AuthProvider ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

pakrym-oai · 2026-04-21T23:05:16Z

+/// Implementations must be cheap and non-blocking. Token refresh, task
+/// registration, and other I/O must happen before request construction reaches
+/// this trait.
+pub trait AuthProvider: Send + Sync {


is this because of a dependency order?

efrazer-oai mentioned this pull request Apr 21, 2026

feat: add explicit AgentIdentity auth mode #18785

Open

efrazer-oai assigned pakrym-oai and shijie-oai Apr 21, 2026

efrazer-oai marked this pull request as ready for review April 21, 2026 05:49

efrazer-oai requested a review from a team as a code owner April 21, 2026 05:49

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from af22d58 to d21eaed Compare April 21, 2026 05:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 86413e2 to 0b61c82 Compare April 21, 2026 05:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from d21eaed to 52b5ad3 Compare April 21, 2026 05:53

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0b61c82 to 52e547c Compare April 21, 2026 05:53

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread codex-rs/core/src/mcp_openai_file.rs Outdated

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from 52b5ad3 to b51b093 Compare April 21, 2026 07:12

efrazer-oai marked this pull request as draft April 21, 2026 07:13

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from b4f801e to b718d3e Compare April 21, 2026 07:22

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from b51b093 to f5befea Compare April 21, 2026 07:22

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from b718d3e to b23a44f Compare April 21, 2026 07:44

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from f5befea to 690d32a Compare April 21, 2026 07:44

efrazer-oai marked this pull request as ready for review April 21, 2026 08:00

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

efrazer-oai requested review from adrian-openai, pakrym-oai and shijie-oai April 21, 2026 15:33

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from b23a44f to 4c2b315 Compare April 21, 2026 19:16

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from efc466e to 37f3339 Compare April 21, 2026 19:16

This was referenced Apr 21, 2026

refactor: add agent identity crate #18871

Open

fix: fully revert agent identity runtime wiring #18757

Merged

efrazer-oai changed the title ~~Migrate Codex backend auth header callers~~ refactor: route Codex auth through AuthProvider Apr 21, 2026

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 4c2b315 to be0d99c Compare April 21, 2026 19:24

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from 37f3339 to dc19ee2 Compare April 21, 2026 19:24

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from be0d99c to 0881c58 Compare April 21, 2026 20:57

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from dc19ee2 to 6784881 Compare April 21, 2026 20:57

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0881c58 to 0f90a02 Compare April 21, 2026 21:03

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from 6784881 to d393a91 Compare April 21, 2026 21:03

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0f90a02 to 8bca584 Compare April 21, 2026 21:36

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch 4 times, most recently from 6145ebf to db51937 Compare April 21, 2026 22:54

efrazer-oai mentioned this pull request Apr 21, 2026

feat: load AgentIdentity from JWT env #18904

Open

pakrym-oai reviewed Apr 21, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 8bca584 to 9679412 Compare April 21, 2026 23:15

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from db51937 to f15803b Compare April 21, 2026 23:19

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 9679412 to c9e8046 Compare April 21, 2026 23:47

efrazer-oai added 2 commits April 21, 2026 16:48

refactor: route codex auth through providers

894a610

refactor: keep authorization headers in provider

ae57449

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-callers branch from f15803b to ae57449 Compare April 21, 2026 23:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor: route Codex auth through AuthProvider#18811

refactor: route Codex auth through AuthProvider#18811
efrazer-oai wants to merge 2 commits intodev/efrazer/agent-identity-auth-runtimefrom
dev/efrazer/agent-identity-auth-callers

efrazer-oai commented Apr 21, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 21, 2026

Uh oh!

pakrym-oai Apr 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	let auth_manager = AuthManager::shared(
	config.codex_home.to_path_buf(),
	/enable_codex_api_key_env/ false,
	config.cli_auth_credentials_store_mode,
	);

Conversation

efrazer-oai commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Callsite Migration

Stack

Testing

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

pakrym-oai Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

efrazer-oai commented Apr 21, 2026 •

edited

Loading