Module auth 

Which credential the CLI would use, without spawning it.

A cheap synchronous pre-flight check for health endpoints and for failing fast with a clear message instead of an opaque non-zero exit. It answers a different question from LoginStatusCommand: that one asks the CLI whether a stored credential is currently valid, this one asks which credential the CLI would pick. Keep both.

Nothing here reads or returns a credential value. Environment variables are reported by name, and stored credentials by mode and presence.

How this was determined

Read off codex-cli 0.145.0 rather than assumed, using codex doctor, which reports its own auth resolution. Each state below is a captured run:

Setup	What the CLI reports
neither	no Codex credentials were found
auth.json only	auth is configured, stored auth mode chatgpt
env var only	auth is provided by environment, auth mode none
both	mixed auth signals: ChatGPT login plus API key env var; HTTP reachability uses API-key mode

The last row is the precedence: with both present the environment key is what reaches the API, and the CLI itself flags the combination as a warning. AuthStrategy::Mixed preserves that rather than silently picking a winner.

codex login status is not the authority here: it reports only stored logins, and says “Not logged in” when an environment variable would in fact be used.

Example

use codex_wrapper::auth::{self, AuthStrategy};

let status = auth::detect();
match &status.strategy {
    AuthStrategy::None => eprintln!("run `codex login` first"),
    AuthStrategy::Mixed { .. } => eprintln!("both configured; the env key wins"),
    other => println!("will authenticate via {other:?}"),
}

Structs

AuthStatus

The result of detect.

Enums

AuthStrategy

Which credential the CLI would use.

Constants

AUTH_ENV_VARS

Environment variables the CLI accepts a credential from.

Functions

detect

Detect how the CLI would authenticate, from the current environment.

detect_in

detect, but against an explicit CODEX_HOME.