Module auth

Modules§

default_client: Default Codex HTTP client: shared User-Agent, originator, optional residency header, and HttpClient construction.
error

AgentIdentityAuth
AgentIdentityAuthRecord
ApiKeyAuth
AuthConfig
AuthDotJson: Expected structure for $CODEX_HOME/auth.json.
AuthHeaders: Request headers returned by an external auth provider.
AuthManager: Central manager providing a single source of truth for auth.json derived authentication data. It loads once (or on preference change) and then hands out cloned CodexAuth values so the rest of the program has a consistent snapshot.
BedrockApiKeyAuth: Managed Amazon Bedrock API key persisted in auth.json.
ChatgptAuth
ChatgptAuthTokens
ExternalAuthRefreshContext
PersonalAccessTokenAuth
RefreshTokenFailedError
UnauthorizedRecovery
UnauthorizedRecoveryStepResult

AgentIdentityAuthError
AgentIdentityAuthPolicy: Policy for resolving Agent Identity auth from a broader Codex auth snapshot.
AgentIdentityStorage
AuthKeyringBackendKind: Determine how auth credentials should use keyring-backed storage.
CodexAuth: Authentication mechanism used by the current user.
ExternalAuthRefreshReason
RefreshTokenError
RefreshTokenFailedReason

AuthManagerConfig: Configuration view required to construct a shared AuthManager.
ExternalAuth: Pluggable auth provider used by AuthManager for externally managed auth flows.

enforce_login_restrictions: Enforces configured login restrictions using auth-owned HTTP settings.
load_auth_dot_json: Load the raw stored auth payload without applying environment overrides.
login_with_access_token: Writes an auth.json that contains only the access token.
login_with_api_key: Writes an auth.json that contains only the API key.
login_with_bedrock_api_key: Writes an auth.json that contains only the Amazon Bedrock API key auth.
login_with_chatgpt_auth_tokens: Writes an in-memory auth payload for externally managed ChatGPT tokens.
logout: Delete the auth.json file inside codex_home if it exists. Returns Ok(true) if a file was removed, Ok(false) if no auth file was present.
logout_with_revoke
oauth_client_id
read_codex_access_token_from_env
read_codex_api_key_from_env
read_openai_api_key_from_env
save_auth: Persist the provided auth payload using the specified backend.