{"record":{"id":"6513c0651c5a5d47","repo":"openai/codex","slug":"websocket-auth-flags-require-ws-auth-capability","errorCode":null,"errorMessage":"websocket auth flags require `--ws-auth capability-token` or `--ws-auth signed-bearer-token`","messagePattern":"websocket auth flags require `--ws-auth capability-token` or `--ws-auth signed-bearer-token`","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server-transport/src/transport/auth.rs","lineNumber":210,"sourceCode":"                        \"--ws-shared-secret-file\",\n                        shared_secret_file,\n                    )?,\n                    issuer: normalize(self.ws_issuer),\n                    audience: normalize(self.ws_audience),\n                    max_clock_skew_seconds: self\n                        .ws_max_clock_skew_seconds\n                        .unwrap_or(DEFAULT_MAX_CLOCK_SKEW_SECONDS),\n                })\n            }\n            None => {\n                if self.ws_token_file.is_some()\n                    || self.ws_token_sha256.is_some()\n                    || self.ws_shared_secret_file.is_some()\n                    || self.ws_issuer.is_some()\n                    || self.ws_audience.is_some()\n                    || self.ws_max_clock_skew_seconds.is_some()\n                {\n                    anyhow::bail!(\n                        \"websocket auth flags require `--ws-auth capability-token` or `--ws-auth signed-bearer-token`\"\n                    );\n                }\n                None\n            }\n        };\n\n        Ok(AppServerWebsocketAuthSettings { config })\n    }\n}\n\npub fn policy_from_settings(\n    settings: &AppServerWebsocketAuthSettings,\n) -> io::Result<WebsocketAuthPolicy> {\n    let mode = match settings.config.as_ref() {\n        Some(AppServerWebsocketAuthConfig::CapabilityToken { source }) => match source {\n            AppServerWebsocketCapabilityTokenSource::TokenFile { token_file } => {\n                let token = read_trimmed_secret(token_file.as_ref())?;","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server-transport/src/transport/auth.rs#L192-L228","documentation":"Error \"websocket auth flags require `--ws-auth capability-token` or `--ws-auth signed-bearer-token`\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/app-server-transport/src/transport/auth.rs:210 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}