{"record":{"id":"838f245d22fc89c0","repo":"jlcodes99/cockpit-tools","slug":"official-auth-json-requires-access-token","errorCode":null,"errorMessage":"Official auth.json requires access_token","messagePattern":"Official auth\\.json requires access_token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/utils/codexExportFormats.ts","lineNumber":547,"sourceCode":"      agent_identity: buildAgentIdentityCredentials(account),\n      type: 'codex',\n    };\n  }\n\n  if (isCodexApiKeyAccount(account)) {\n    const apiKey = account.openai_api_key?.trim();\n    if (!apiKey) {\n      throw new Error('Official auth.json requires OPENAI_API_KEY for API Key accounts');\n    }\n    return {\n      auth_mode: 'apikey',\n      OPENAI_API_KEY: apiKey,\n    };\n  }\n\n  const accessToken = account.tokens?.access_token?.trim() || '';\n  if (!accessToken) {\n    throw new Error('Official auth.json requires access_token');\n  }\n\n  if (isPersonalAccessTokenAccount(account)) {\n    return {\n      OPENAI_API_KEY: null,\n      personal_access_token: accessToken,\n      type: 'codex',\n    };\n  }\n\n  return {\n    OPENAI_API_KEY: null,\n    tokens: {\n      id_token: account.tokens?.id_token || '',\n      access_token: accessToken,\n      refresh_token: account.tokens?.refresh_token?.trim() || '',\n      account_id: resolveAccountId(account) || '',\n    },","sourceCodeStart":529,"sourceCodeEnd":565,"githubUrl":"https://github.com/jlcodes99/cockpit-tools/blob/1ed8b77992d62ca81fabf744deb0839ad361d5bf/src/utils/codexExportFormats.ts#L529-L565","documentation":"toOfficialAuthJson throws this error when the account is not an API-key account and its tokens.access_token is missing or blank. Every official auth.json variant for non-API-key accounts (OAuth, personal access token) requires an access token.","triggerScenarios":"Calling toOfficialAuthJson on a non-API-key account where account.tokens?.access_token trims to empty — e.g. OAuth never completed, tokens cleared after failed refresh, or partially imported data.","commonSituations":"Interrupted OAuth login; token wiped by an auth failure; migration from an older storage format that lost the token field.","solutions":["Re-run the OAuth flow to repopulate tokens.access_token","Verify the account's auth type classification before export","Skip accounts without access tokens in the export batch","Restore tokens via a quota/auth refresh that re-authenticates the account"],"exampleFix":"// before\nconst auth = toOfficialAuthJson(account); // throws\n// after\nif (account.tokens?.access_token?.trim()) {\n  const auth = toOfficialAuthJson(account);\n}","handlingStrategy":"validation","validationCode":"if (!isCodexApiKeyAccount(account) && !account.tokens?.access_token?.trim()) {\n  throw new Error('account missing access_token for auth.json');\n}","typeGuard":"function isExportableAuthAccount(a: CodexAccount): boolean {\n  return isCodexApiKeyAccount(a) ? !!a.openai_api_key?.trim() : !!a.tokens?.access_token?.trim();\n}","tryCatchPattern":"try {\n  const auth = toOfficialAuthJson(account);\n} catch (e) {\n  if ((e as Error).message === 'Official auth.json requires access_token') {\n    // trigger re-auth or skip account\n  }\n}","preventionTips":["Re-authenticate accounts whose tokens are missing before export","Avoid clearing tokens on transient refresh failures","Pre-flight export batches for access_token presence"],"tags":["oauth","access-token","auth-json","export"],"backgroundTag":"missing-credential-field","analyzedSha":"1ed8b77992d62ca81fabf744deb0839ad361d5bf","analyzedAt":"2026-09-05T09:51:41.178Z","contentChangedAt":"2026-09-05T09:51:41.178Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}