{"record":{"id":"415435bb1b8d0fe3","repo":"openai/codex","slug":"ws-token-file-and-ws-token-sha256-require","errorCode":null,"errorMessage":"`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`","messagePattern":"`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server-transport/src/transport/auth.rs","lineNumber":174,"sourceCode":"                }\n                let source = match (self.ws_token_file, self.ws_token_sha256) {\n                    (Some(_), Some(_)) => {\n                        anyhow::bail!(\n                            \"`--ws-token-file` and `--ws-token-sha256` are mutually exclusive\"\n                        );\n                    }\n                    (Some(token_file), None) => {\n                        AppServerWebsocketCapabilityTokenSource::TokenFile {\n                            token_file: absolute_path_arg(\"--ws-token-file\", token_file)?,\n                        }\n                    }\n                    (None, Some(token_sha256)) => {\n                        AppServerWebsocketCapabilityTokenSource::TokenSha256 {\n                            token_sha256: sha256_digest_arg(\"--ws-token-sha256\", &token_sha256)?,\n                        }\n                    }\n                    (None, None) => {\n                        anyhow::bail!(\n                            \"`--ws-token-file` or `--ws-token-sha256` is required when `--ws-auth capability-token` is set\"\n                        );\n                    }\n                };\n                Some(AppServerWebsocketAuthConfig::CapabilityToken { source })\n            }\n            Some(WebsocketAuthCliMode::SignedBearerToken) => {\n                if self.ws_token_file.is_some() || self.ws_token_sha256.is_some() {\n                    anyhow::bail!(\n                        \"`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`\"\n                    );\n                }\n                let shared_secret_file = self.ws_shared_secret_file.context(\n                    \"`--ws-shared-secret-file` is required when `--ws-auth signed-bearer-token` is set\",\n                )?;\n                Some(AppServerWebsocketAuthConfig::SignedBearerToken {\n                    shared_secret_file: absolute_path_arg(\n                        \"--ws-shared-secret-file\",","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server-transport/src/transport/auth.rs#L156-L192","documentation":"Error \"`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/app-server-transport/src/transport/auth.rs:174 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}