PAT onboarding

[masterkain]

in upstream Codex, it is now a new way to authenticate Codex against ChatGPT/Codex backend without a full auth.json refresh-token bundle. it is an opaque token starting with at-, not
a JWT. Codex now accepts it via codex login --with-access-token or CODEX_ACCESS_TOKEN, calls AuthAPI whoami to hydrate account metadata, then uses the PAT directly as the bearer
token.

impact for us:

• this is upstream identity auth, not pool api-key auth
  users still call codex-pooler with our pool keys; PATs would matter for the upstream accounts we import/use behind the pool

• current admin import is auth.json-oriented
  if someone gives us an at-... PAT, we probably cannot onboard it cleanly today through /admin/upstreams

• manual storage might partly work, but it is risky
  because dispatch likely only needs a bearer token, but refresh, quota, display, account matching, workspace slotting, and reauth status all depend on trusted metadata we normally
  derive from auth.json/refresh flow

• PATs are probably not refreshable
  so our token-refresh job/UI semantics need to know “this credential must be revalidated/replaced”, not “try refresh_token grant”

• workspace/account identity is the subtle bit
  upstream explicitly hydrates metadata through whoami; we should do the same before creating or matching an UpstreamIdentity, otherwise we can attach the PAT to the wrong identity
  slot or lack chatgpt_account_id/plan evidence

[masterkain]

• create it in chatgpt admin console:

https://chatgpt.com/admin/access-tokens

requirements:

• chatgpt business/enterprise workspace
• workspace admin must enable it under workspace settings > permissions & roles
• in codex local, enable allow members to use codex access tokens
• then access token page -> create -> name + expiration -> copy once

official docs: codex access tokens (https://developers.openai.com/codex/enterprise/access-tokens)

after creation, codex uses it like:

export CODEX_ACCESS_TOKEN="at-..."
codex exec --json "..."

or persistent local login:

printf '%s' "$CODEX_ACCESS_TOKEN" | codex login --with-access-token

[deadcoder0904]

@masterkain does that mean plus or pro plan users can't use it consistently???

im using another tool cockpit-tools & its been bugging since recently. everytime i switch providers, it just logsout & asks for oauth again. im assuming switching to ur tool would make it similar.

Codex authorization is invalid: the refresh_token was already used by another client or instance. Sign in again, and avoid refreshing the same account from official Codex, other instances, or external tools at the same time.

^^ this is the error

is there any way to solve it for plus or pro plan? or is it only possible with business / enterprise plan? i tested it in one of my browsers which has go plan but it didn't have https://chatgpt.com/admin/access-tokens

all i want to is to use all my accounts in a stable manner without having to login again & again. it keeps asking for otp too all the time when that happens. start happening ~2-3 weeks ago but before that, it wasn't an issue for a long time.

[masterkain]

this concerns just the business/enterprise accounts and even then it should be optional
I opened the ticket because I don't have personally an enterprise account to test out this new authentication method, but your account(s) should work fine, give it a try

[deadcoder0904]

cool, i'll test codex-pooler then. it doesn't need switching accounts right like cockpit after login unless i wanna use codex app specifically? just 1 api to use them directly?

[masterkain]

at first run you will bootstrap the instance, then you create a pool, like "Dev"

then you can start linking your openai codex account, create an api key, configure the client and you're good to go, you can ask your llm to read up the docs and configure your client

however atm we support linkage through Device Code, it's something OpenAI has not enabled by default, so if you don't have set that already go to chatgpt.com, settings bottom left, security, and then select "Enable device code authorization for Codex" if using the invitation flow