{"record":{"id":"a6df976d4783b585","repo":"mastra-ai/mastra","slug":"not-logged-in-to-openai-codex","errorCode":null,"errorMessage":"Not logged in to OpenAI Codex.","messagePattern":"Not logged in to OpenAI Codex\\.","errorType":"exception","errorClass":"ProviderAuthRequiredError","httpStatus":null,"severity":"error","filePath":"mastracode/sdk/src/providers/openai-codex.ts","lineNumber":135,"sourceCode":" * Get a live OAuth bearer token for the Codex OAuth credential.\n *\n * Refreshes the token if it's expired, and returns the credential's\n * accountId alongside the access token. Throws if the user isn't logged in\n * or if the refresh fails.\n *\n * This is the only piece of Codex auth that is genuinely shared between\n * the main agent's fetch (`buildOpenAICodexOAuthFetch`) and the Stagehand\n * fetch (`buildCodexStagehandFetch`).\n */\nasync function getCodexBearer(\n  authStorage?: CredentialStore,\n): Promise<{ accessToken: string; accountId: string | undefined }> {\n  const storage = authStorage ?? getAuthStorage();\n  storage.reload();\n\n  const cred = storage.get('openai-codex');\n  if (!cred || cred.type !== 'oauth') {\n    throw new ProviderAuthRequiredError('Not logged in to OpenAI Codex.');\n  }\n\n  let accessToken = cred.access;\n  if (Date.now() >= cred.expires) {\n    const refreshedToken = await storage.getApiKey('openai-codex');\n    if (!refreshedToken) {\n      throw new ProviderAuthRequiredError('Failed to refresh the OpenAI Codex token.');\n    }\n    accessToken = refreshedToken;\n    storage.reload();\n  }\n\n  return { accessToken, accountId: (cred as any).accountId as string | undefined };\n}\n\n/**\n * Build a fetch function that handles OpenAI Codex OAuth.\n * Preserves non-authorization headers from init.","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/mastracode/sdk/src/providers/openai-codex.ts#L117-L153","documentation":"getCodexBearer resolves the OpenAI Codex OAuth bearer token used by both the agent fetch and the Stagehand fetch. It reloads the credential store and requires an 'openai-codex' credential of type 'oauth'. If absent or of another type, it throws ProviderAuthRequiredError('Not logged in to OpenAI Codex.').","triggerScenarios":"Any request via buildOpenAICodexOAuthFetch or buildCodexStagehandFetch when the credential store has no 'openai-codex' entry or that entry's type is not 'oauth' (e.g. api-key credential, null after reload).","commonSituations":"User never ran the Codex OAuth login; credentials cleared or logged out; a ChatGPT/API-key credential stored under 'openai-codex' so the type check fails; CI environment without the credentials file; passing an empty custom authStorage.","solutions":["Run the OpenAI Codex OAuth login flow to store the 'openai-codex' oauth credential.","Verify the credentials store contains an 'openai-codex' entry with type 'oauth'.","If using a custom authStorage (opts.authStorage), populate it or point it at the real credential store.","Confirm you are not overwriting the entry with an api-key type credential elsewhere in your setup."],"exampleFix":"// before\nconst fetch = buildOpenAICodexOAuthFetch(); // throws when not logged in\n// after\nif (!authStorage.get('openai-codex') || authStorage.get('openai-codex').type !== 'oauth') {\n  await codexLogin(); // OAuth device/browser flow\n}\nconst fetch = buildOpenAICodexOAuthFetch({ authStorage });","handlingStrategy":"validation","validationCode":"const cred = storage.get('openai-codex');\nif (!cred || cred.type !== 'oauth') {\n  throw new Error('OpenAI Codex login required; run the Codex OAuth flow first');\n}","typeGuard":"function isCodexOAuthCred(c: unknown): c is { type: 'oauth'; access: string; expires: number } {\n  return !!c && typeof c === 'object' && (c as any).type === 'oauth' &&\n    typeof (c as any).access === 'string' && typeof (c as any).expires === 'number';\n}","tryCatchPattern":"try {\n  return await codexFetch(url, init);\n} catch (e) {\n  if (e instanceof ProviderAuthRequiredError && /Not logged in/.test(e.message)) {\n    await codexLogin();\n    return await codexFetch(url, init);\n  }\n  throw e;\n}","preventionTips":["Check Codex auth state at startup and prompt for login when absent.","Don't overwrite the 'openai-codex' entry with a non-oauth credential.","Provision credentials in CI or skip Codex-dependent steps."],"tags":["auth","oauth","openai-codex","login-required"],"backgroundTag":"provider-not-authenticated","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}