Expand description
Bounded browser authentication for the ChatGPT Codex subscription API.
This module deliberately owns only the OAuth and credential-store boundary. It does not decide which provider a session uses.
Structs§
- Auth
Error - Auth
Store - A private, symlink-safe JSON credential store.
- Codex
Credentials - OAuth material persisted by Lucy. The JSON names are intentionally short because this file is user-managed state, while aliases let a future migration read conventional token names.
- OAuth
Endpoints - Pkce
Challenge
Constants§
- CALLBACK_
HOST - CALLBACK_
PATH - CALLBACK_
PORT - CALLBACK_
REDIRECT_ HOST - DEFAULT_
AUTH_ ISSUER - DEFAULT_
CLIENT_ ID - DEFAULT_
TOKEN_ ENDPOINT - REFRESH_
WINDOW_ SECONDS
Functions§
- credential_
path - Resolve Lucy’s credential path without assuming that either XDG variable is set.
- credential_
path_ from_ xdg - generate_
pkce - login
- Perform the browser authorization-code flow and persist the returned credentials.
- login_
with_ endpoints - refresh_
credentials - Refresh a credential set, retaining a rotated refresh token when the authority returns one.