{"record":{"id":"1991a2fe909516cb","repo":"openai/codex","slug":"api-key-is-too-large-to-fit-in-the-buffer-size-b","errorCode":null,"errorMessage":"API key is too large to fit in the {BUFFER_SIZE}-byte buffer","messagePattern":"API key is too large to fit in the (.+?)-byte buffer","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/responses-api-proxy/src/read_api_key.rs","lineNumber":123,"sourceCode":"        }\n\n        // Search only the newly written region for a newline.\n        let newly_written = &slice[..read];\n        if let Some(pos) = newly_written.iter().position(|&b| b == b'\\n') {\n            total_read += pos + 1; // include the newline for trimming below\n            saw_newline = true;\n            break;\n        }\n\n        total_read += read;\n\n        // Continue loop; if buffer fills without newline/EOF we'll error below.\n    }\n\n    // If buffer filled and we did not see newline or EOF, error out.\n    if total_read == capacity && !saw_newline && !saw_eof {\n        buf.zeroize();\n        return Err(anyhow!(\n            \"API key is too large to fit in the {BUFFER_SIZE}-byte buffer\"\n        ));\n    }\n\n    let mut total = prefix_len + total_read;\n    while total > prefix_len && (buf[total - 1] == b'\\n' || buf[total - 1] == b'\\r') {\n        total -= 1;\n    }\n\n    if total == AUTH_HEADER_PREFIX.len() {\n        buf.zeroize();\n        return Err(anyhow!(\n            \"API key must be provided via stdin (e.g. printenv OPENAI_API_KEY | codex responses-api-proxy)\"\n        ));\n    }\n\n    if let Err(err) = validate_auth_header_bytes(&buf[AUTH_HEADER_PREFIX.len()..total]) {\n        buf.zeroize();","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/responses-api-proxy/src/read_api_key.rs#L105-L141","documentation":"The proxy reads the API key from stdin into a fixed 1024-byte stack buffer; after the 'Bearer ' prefix, 1017 bytes remain for the token. If the token region fills completely without a newline or EOF delimiting the key, read_auth_header_with zeroizes the buffer and returns this error rather than truncating silently.","triggerScenarios":"Piping 1017 or more bytes that contain no newline within the buffer window - for example cat'ing a PEM key, a .env file, or a JSON blob instead of a single-line API key.","commonSituations":"Piping the wrong file (certificate, credentials JSON, multi-line env dump) into the proxy; concatenating several values into one stream; hypothetical future tokens longer than 1KB.","solutions":["Pipe only the single-line key: printenv OPENAI_API_KEY | codex responses-api-proxy ...","Check the length first: test ${#OPENAI_API_KEY} -lt 1000","If keys longer than 1KB are genuinely required, raise BUFFER_SIZE in read_api_key.rs and rebuild"],"exampleFix":"# before: 1017+ bytes, no newline\ncat credentials.json | codex responses-api-proxy --upstream-url http://localhost:3000\n# after\nprintenv OPENAI_API_KEY | codex responses-api-proxy --upstream-url http://localhost:3000","handlingStrategy":"validation","validationCode":"#!/bin/sh\n[ -n \"$OPENAI_API_KEY\" ] || { echo 'missing OPENAI_API_KEY' >&2; exit 1; }\n[ \"${#OPENAI_API_KEY}\" -lt 1000 ] || { echo 'key exceeds the 1017-byte stdin buffer' >&2; exit 1; }\nprintenv OPENAI_API_KEY | codex responses-api-proxy \"$@\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never cat files into the proxy - pipe the exact environment variable","Keep keys single-line and well under 1KB","Wrap invocations in a script that validates length before piping"],"tags":["rust","stdin","api-key","input-validation"],"backgroundTag":"api-key-too-long","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}