[Feature]: Configure device-code-only Codex authentication

Open
  • Is something wrong?
#8,082 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
30/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
authentication, backend, frontend

Research direction

Start with gui/src/components/use-add-codex-account-oauth.ts, where startOAuth() runs on reauthAccountId without the device option, then check the backend src/codex/auth-api/login-flow.ts, which already accepts device: true. Design the persistent Codex auth-method setting and decide where it is enforced. Done means a device-only opt-in starts the device flow directly for add and reauthenticate, with the default behavior unchanged and same-account checks kept.

Written by the indexing model from the issue text.

Description

account-pool enhancement
Area

Authentication and account pool

What are you trying to accomplish?

Operate a headless OpenCodex hub in Kubernetes using only the ChatGPT/Codex device-code login flow, including when reauthenticating an existing pool account from the dashboard. An operator should be able to complete the login on another device without first starting a localhost callback flow.

What prevents this today?

The dashboard reauthentication modal automatically starts browser OAuth: gui/src/components/use-add-codex-account-oauth.ts calls startOAuth() when reauthAccountId is set, without the device option. The same hook sends device: true only for an explicit device selection. In a remote hub this immediately creates an unwanted browser login attempt, and a subsequent device attempt can encounter a login-already-in-progress conflict. The reported dashboard showed that conflict; its precise cause has not been established. The existing open-browser preference is not a device-flow preference.

What should OpenCodex do?

Provide an explicit, persistent Codex authentication method setting that can select device-code-only operation. When enabled, dashboard add and reauthentication actions should start the device flow directly, without automatically starting a browser callback flow. Make the setting apply consistently to relevant Codex login entry points, and make its enforcement and scope clear to the operator. Preserve existing behavior by default for installations that do not opt in. Device authorization remains OAuth; this request is about the authorization flow, not removing OAuth or changing other providers.

Example usage or interface

For example, an operator enables a Codex authentication setting in the dashboard or configuration and chooses device-only. Clicking Reauthenticate on a pool account immediately displays the verification URL and short device code; no localhost callback login is started. The exact setting name and interface are implementation choices. The device login must retain the existing same-account identity checks for reauthentication.

Alternatives or workarounds

The existing dashboard device-flow choice and the ocx account login openai --id <account-id> --reauth --device CLI option can start a device login explicitly, but the reauthentication modal first starts browser OAuth automatically. Issue #3366 introduced device authorization support; it did not request a persistent device-only policy. Issue #3898 concerns the separate native main account reauthentication path, not a default or restriction for Codex login methods.

Additional context

The affected installation is a remote single-replica Kubernetes hub. The backend already accepts device: true in src/codex/auth-api/login-flow.ts, so this request is for selection and optional enforcement of the existing flow rather than a new OAuth implementation.

Checks
  • I searched existing issues and documentation.
  • This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
  • I removed secrets and personal data.
Dominant language
TypeScript
Stars
16.9k
Forks
1.3k
Avg merge
16h 51m
Merged PRs (30d)
681

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from lidge-jun/opencodex

All issues in lidge-jun/opencodex

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.