{"record":{"id":"9c09e3daa139ea72","repo":"jlcodes99/cockpit-tools","slug":"official-auth-json-requires-openai-api-key-for-api","errorCode":null,"errorMessage":"Official auth.json requires OPENAI_API_KEY for API Key accounts","messagePattern":"Official auth\\.json requires OPENAI_API_KEY for API Key accounts","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/utils/codexExportFormats.ts","lineNumber":537,"sourceCode":"    !refreshToken &&\n    !hasAgentIdentity(account) &&\n    !isCodexApiKeyAccount(account)\n  );\n}\n\nfunction toOfficialAuthJson(account: CodexAccount): JsonRecord {\n  if (hasAgentIdentity(account)) {\n    return {\n      auth_mode: 'agentIdentity',\n      agent_identity: buildAgentIdentityCredentials(account),\n      type: 'codex',\n    };\n  }\n\n  if (isCodexApiKeyAccount(account)) {\n    const apiKey = account.openai_api_key?.trim();\n    if (!apiKey) {\n      throw new Error('Official auth.json requires OPENAI_API_KEY for API Key accounts');\n    }\n    return {\n      auth_mode: 'apikey',\n      OPENAI_API_KEY: apiKey,\n    };\n  }\n\n  const accessToken = account.tokens?.access_token?.trim() || '';\n  if (!accessToken) {\n    throw new Error('Official auth.json requires access_token');\n  }\n\n  if (isPersonalAccessTokenAccount(account)) {\n    return {\n      OPENAI_API_KEY: null,\n      personal_access_token: accessToken,\n      type: 'codex',\n    };","sourceCodeStart":519,"sourceCodeEnd":555,"githubUrl":"https://github.com/jlcodes99/cockpit-tools/blob/1ed8b77992d62ca81fabf744deb0839ad361d5bf/src/utils/codexExportFormats.ts#L519-L555","documentation":"toOfficialAuthJson throws this error when the account is classified as an API Key account (isCodexApiKeyAccount) but its openai_api_key is missing or blank. An official Codex auth.json with auth_mode='apikey' must contain a non-empty OPENAI_API_KEY.","triggerScenarios":"Calling toOfficialAuthJson (export to official auth.json) on an account where isCodexApiKeyAccount(account) is true and openai_api_key trims to empty.","commonSituations":"Account typed as API-key during creation but key never filled in; key removed by an edit; account data imported from a source that omitted the key.","solutions":["Enter the OPENAI_API_KEY on the account before exporting auth.json","Fix the account's auth-type classification if it is wrongly tagged as API-key","Skip key-less API-key accounts in the export selection","Validate the key field when saving the account to prevent key-less API-key accounts"],"exampleFix":"// before\nconst auth = toOfficialAuthJson(account); // throws\n// after\nif (!isCodexApiKeyAccount(account) || account.openai_api_key?.trim()) {\n  const auth = toOfficialAuthJson(account);\n}","handlingStrategy":"validation","validationCode":"if (isCodexApiKeyAccount(account) && !account.openai_api_key?.trim()) {\n  throw new Error('API key account missing OPENAI_API_KEY');\n}","typeGuard":"function isExportableApiKeyAccount(a: CodexAccount): boolean {\n  return !isCodexApiKeyAccount(a) || !!a.openai_api_key?.trim();\n}","tryCatchPattern":"try {\n  const auth = toOfficialAuthJson(account);\n} catch (e) {\n  if ((e as Error).message.includes('requires OPENAI_API_KEY')) {\n    // ask user to fill in the key\n  }\n}","preventionTips":["Enforce non-empty key when saving API-key accounts","Verify auth-type classification before exporting","Skip unexportable accounts in batch selections"],"tags":["validation","api-key","auth-json","export"],"backgroundTag":"missing-credential-field","analyzedSha":"1ed8b77992d62ca81fabf744deb0839ad361d5bf","analyzedAt":"2026-09-05T09:51:41.178Z","contentChangedAt":"2026-09-05T09:51:41.178Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}