Module auth 

OAuth authentication for ChatGPT subscription accounts.

Two login paths are provided:

• Browser flow: Pkce::authorize_url + listen_for_callback + exchange_code. The redirect URI is fixed by the registered client ID (http://localhost:1455/auth/callback).
• Device flow (headless/SSH): request_device_code + poll_device_code + exchange_code. Unlike standard OAuth device flow, the PKCE verifier is issued by the server during polling, not generated by the client.

Access tokens are short-lived; use refresh_tokens with the stored refresh token. Note that OpenAI rotates refresh tokens: every successful refresh returns a new refresh token that must replace the old one.

Structs

CodexCredentials

Persisted ChatGPT OAuth credentials.

DeviceCodeResponse

Response shape of POST /api/accounts/deviceauth/usercode.

Pkce

PKCE verifier/challenge pair plus the OAuth state nonce.

Functions

exchange_code

Exchange an authorization code + PKCE verifier for credentials.

listen_for_callback

Listen on localhost:1455 for a single OAuth callback and return the authorization code.

poll_device_code

Poll once for device authorization completion.

refresh_tokens

Exchange a refresh token for a fresh credential set.

request_device_code

Begin the device-authorization flow (for SSH/headless environments where a browser on localhost:1455 is unavailable).