{"record":{"id":"4a754403db1359a5","repo":"paperclipai/paperclip","slug":"agent-authentication-required","errorCode":null,"errorMessage":"Agent authentication required","messagePattern":"Agent authentication required","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/src/routes/agents.ts","lineNumber":3288,"sourceCode":"  // nothing about that sandbox, so the route checks the environment's own\n  // OPENAI_API_KEY binding instead and otherwise reports \"unknown\" -- never\n  // \"present\" from a host login the sandbox does not share.\n  async function evaluateCodexAuthSignal(\n    req: Request,\n    companyId: string,\n    environmentId: string | null,\n  ): Promise<AdapterAuthSignal> {\n    if (environmentId) {\n      const environment = await environmentsSvc.getById(environmentId);\n      if (environment && environment.driver !== \"local\") {\n        const environmentEnv = Object.fromEntries(\n          Object.entries(parseObject(environment.envVars)).filter(\n            ([key]) => !isForbiddenConfigEnvKey(key),\n          ),\n        );\n        const apiKeyBinding = environmentEnv.OPENAI_API_KEY;\n        if (apiKeyBinding !== undefined) {\n          const resolution = await secretsSvc.resolveEnvBindings(\n            companyId,\n            { OPENAI_API_KEY: apiKeyBinding },\n            buildActorSecretContext(req, { consumerType: \"environment\", consumerId: environmentId }),\n          );\n          if (asNonEmptyString(resolution.env.OPENAI_API_KEY)) {\n            return \"present\";\n          }\n        }\n        return \"unknown\";\n      }\n    }\n\n    const readiness = await evaluateCodexCredentialReadiness({\n      env: process.env,\n      companyId,\n      configuredCodexHome: null,\n      configuredApiKey: null,\n    });","sourceCodeStart":3270,"sourceCodeEnd":3306,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/agents.ts#L3270-L3306","documentation":"Authenticity sentinel in the agents routes: the caller attempted an agent-authenticated operation without valid agent credentials (missing/invalid agent API key on an endpoint that accepts agent actors), so the request is rejected rather than falling back to anonymous access.","triggerScenarios":"Thrown at server/src/routes/agents.ts:2864 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Authenticate with a valid agent API key (Authorization: Bearer ...) and retry."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}