feat(app-server): support external auth mode #10012

owenlin0 · 2026-01-27T19:10:55Z

This enables a new use case where codex app-server is embedded into a parent application that will directly own the user's ChatGPT auth lifecycle, which means it owns the user’s auth tokens and refreshes it when necessary. The parent application would just want a way to pass in the auth tokens for codex to use directly.

The idea is that we are introducing a new "auth mode" currently only exposed via app server: chatgptAuthTokens which consist of the id_token (stores account metadata) and access_token (the bearer token used directly for backend API calls). These auth tokens are only stored in-memory. This new mode is in addition to the existing apiKey and chatgpt auth modes.

This PR reuses the shape of our existing app-server account APIs as much as possible:

Update account/login/start with a new chatgptAuthTokens variant, which will allow the client to pass in the tokens and have codex app-server use them directly. Upon success, the server emits account/login/completed and account/updated notifications.
A new server->client request called account/chatgptAuthTokens/refresh which the server can use whenever the access token previously passed in has expired and it needs a new one from the parent application.

I leveraged the core 401 retry loop which typically triggers auth token refreshes automatically, but made it pluggable:

chatgpt mode refreshes internally, as usual.
chatgptAuthTokens mode calls the client via account/chatgptAuthTokens/refresh, the client responds with updated tokens, codex updates its in-memory auth, then retries. This RPC has a 10s timeout and handles JSON-RPC errors from the client.

Also some additional things:

chatgpt logins are blocked while external auth is active (have to log out first. typically clients will pick one OR the other, not support both)
account/logout clears external auth in memory
Ensures that if forced_chatgpt_workspace_id is set via the user's config, we respect it in both:
- account/login/start with chatgptAuthTokens (returns a JSON-RPC error back to the client)
- account/chatgptAuthTokens/refresh (fails the turn, and on next request app-server will send another account/chatgptAuthTokens/refresh request to the client).

owenlin0 · 2026-01-27T20:28:54Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d8e3f6349

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/app-server/src/message_processor.rs

codex-rs/core/src/auth.rs

owenlin0 · 2026-01-27T21:57:46Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 066d53b68e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/app-server/src/codex_message_processor.rs

owenlin0 · 2026-01-27T22:33:03Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1437b502f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/auth.rs

owenlin0 · 2026-01-27T23:06:29Z

@codex review

chatgpt-codex-connector · 2026-01-27T23:20:16Z

Codex Review: Didn't find any major issues. Nice work!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

owenlin0 · 2026-01-28T00:26:07Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ef1bc6bb68

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/auth.rs

owenlin0 · 2026-01-28T00:58:21Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89629234c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/app-server/README.md

owenlin0 · 2026-01-28T16:40:41Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 083c2f1d87

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/auth.rs

owenlin0 · 2026-01-28T17:50:02Z

@codex review

chatgpt-codex-connector · 2026-01-28T18:04:27Z

Codex Review: Didn't find any major issues. What shall we delve into next?

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/app-server-protocol/src/protocol/common.rs

codex-rs/app-server/src/codex_message_processor.rs

celia-oai · 2026-01-28T22:52:06Z

chatted offline, we'll hide the ephemeral logic in storage.rs so it's abstracted away from auth.rs.

owenlin0 · 2026-01-28T23:57:50Z

@codex review

chatgpt-codex-connector · 2026-01-29T00:11:14Z

Codex Review: Didn't find any major issues. Keep it up!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

owenlin0 · 2026-01-29T00:46:11Z

@codex review

codex-rs/app-server/README.md

celia-oai · 2026-01-29T23:07:59Z

the code lgtm, can we also test out that there's no regression & test out the new endpoints (log in, refresh) in a local build end-to-end?

owenlin0 · 2026-01-29T23:11:03Z

@celia-oai yep, tested this build locally as well

codex-rs/app-server/README.md

bolinfest · 2026-01-29T23:47:24Z

I think we need some documentation that declares the intent behind this AuthMode. Does it represent:

the default Responses endpoint to use for the "openai" provider:

codex/codex-rs/core/src/model_provider_info.rs

Lines 140 to 144 in b79bf69

    
           let default_base_url = if matches!(auth_mode, Some(AuthMode::ChatGPT)) { 
        
               "https://chatgpt.com/backend-api/codex" 
        
           } else { 
        
               "https://api.openai.com/v1" 
        
           };

features to show in the TUI (if there are any that are specific to ChatGPT users)?
how to get an auth token?

To me, it feels like AuthMode should specify 1 and 2, but CodexAuth should specify 3.

bolinfest · 2026-01-29T23:48:59Z

This is maybe OK for now, but ultimately, I think we should be focused on pulling the auth tokens out of the app server rather than pushing them in. That is, I would rather see a new CodexAuth variant like EndpointProvidedAuth that means "rely on the endpoint to ensure HTTP requests are authenticated" that could be applicable to either AuthMode::ApiKey or AuthMode::ChatGPT.

owenlin0 marked this pull request as ready for review January 27, 2026 20:28

chatgpt-codex-connector bot reviewed Jan 27, 2026

View reviewed changes

codex-rs/app-server/src/message_processor.rs Outdated Show resolved Hide resolved

codex-rs/core/src/auth.rs Outdated Show resolved Hide resolved

owenlin0 force-pushed the owen/set_auth_token branch from 92fc6e1 to 066d53b Compare January 27, 2026 21:57

chatgpt-codex-connector bot reviewed Jan 27, 2026

View reviewed changes

codex-rs/app-server/src/codex_message_processor.rs Outdated Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Jan 27, 2026

View reviewed changes

codex-rs/core/src/auth.rs Outdated Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Jan 28, 2026

View reviewed changes

codex-rs/core/src/auth.rs Outdated Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Jan 28, 2026

View reviewed changes

codex-rs/app-server/README.md Outdated Show resolved Hide resolved

owenlin0 force-pushed the owen/set_auth_token branch from 8fc3b23 to 083c2f1 Compare January 28, 2026 16:38

chatgpt-codex-connector bot reviewed Jan 28, 2026

View reviewed changes

codex-rs/core/src/auth.rs Outdated Show resolved Hide resolved

owenlin0 requested review from bolinfest and celia-oai January 28, 2026 18:11

celia-oai reviewed Jan 28, 2026

View reviewed changes

codex-rs/app-server-protocol/src/protocol/common.rs Show resolved Hide resolved

celia-oai reviewed Jan 28, 2026

View reviewed changes

codex-rs/app-server/src/codex_message_processor.rs Show resolved Hide resolved

owenlin0 force-pushed the owen/set_auth_token branch from 0129f58 to 6a0c20f Compare January 29, 2026 00:15

feat(app-server): support external auth mode

d307824

owenlin0 force-pushed the owen/set_auth_token branch from 885db36 to d307824 Compare January 29, 2026 18:30

fix

7298bd8

celia-oai reviewed Jan 29, 2026

View reviewed changes

codex-rs/app-server/README.md Outdated Show resolved Hide resolved

remove mention of chatgpt auth tokens from readme

f7a5962

celia-oai approved these changes Jan 29, 2026

View reviewed changes

codex-rs/app-server/README.md Outdated Show resolved Hide resolved

update

431d562

owenlin0 enabled auto-merge (squash) January 29, 2026 23:20

owenlin0 merged commit 81a17bb into main Jan 29, 2026
51 of 53 checks passed

owenlin0 deleted the owen/set_auth_token branch January 29, 2026 23:46

github-actions bot locked and limited conversation to collaborators Jan 29, 2026

feat(app-server): support external auth mode #10012

feat(app-server): support external auth mode #10012

Conversation

owenlin0 commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

owenlin0 commented Jan 27, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

owenlin0 commented Jan 27, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

owenlin0 commented Jan 27, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

owenlin0 commented Jan 27, 2026

Uh oh!

chatgpt-codex-connector bot commented Jan 27, 2026

Uh oh!

owenlin0 commented Jan 28, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

owenlin0 commented Jan 28, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

owenlin0 commented Jan 28, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

owenlin0 commented Jan 28, 2026

Uh oh!

chatgpt-codex-connector bot commented Jan 28, 2026

Uh oh!

Uh oh!

Uh oh!

celia-oai commented Jan 28, 2026

Uh oh!

owenlin0 commented Jan 28, 2026

Uh oh!

chatgpt-codex-connector bot commented Jan 29, 2026

Uh oh!

owenlin0 commented Jan 29, 2026

Uh oh!

Uh oh!

celia-oai commented Jan 29, 2026

Uh oh!

owenlin0 commented Jan 29, 2026

Uh oh!

Uh oh!

Uh oh!

bolinfest commented Jan 29, 2026

Uh oh!

bolinfest commented Jan 29, 2026

Uh oh!

Reviewers

Assignees

owenlin0 commented Jan 27, 2026 •

edited

Loading