{"record":{"id":"b1a9b56dabee9637","repo":"openai/codex","slug":"api-key-may-only-contain-ascii-letters-numbers","errorCode":null,"errorMessage":"API key may only contain ASCII letters, numbers, '-' or '_'","messagePattern":"API key may only contain ASCII letters, numbers, '-' or '_'","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/responses-api-proxy/src/read_api_key.rs","lineNumber":216,"sourceCode":"    }\n\n    let _ = unsafe { mlock(start as *const c_void, size) };\n}\n\n#[cfg(not(unix))]\nfn mlock_str(_value: &str) {}\n\n/// The key should match /^[A-Za-z0-9\\-_]+$/. Ensure there is no funny business\n/// with NUL characters and whatnot.\nfn validate_auth_header_bytes(key_bytes: &[u8]) -> Result<()> {\n    if key_bytes\n        .iter()\n        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))\n    {\n        return Ok(());\n    }\n\n    Err(anyhow!(\n        \"API key may only contain ASCII letters, numbers, '-' or '_'\"\n    ))\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use std::collections::VecDeque;\n    use std::io;\n\n    #[test]\n    fn reads_key_with_no_newlines() {\n        let mut sent = false;\n        let result = read_auth_header_with(|buf| {\n            if sent {\n                return Ok(0);\n            }\n            let data = b\"sk-abc123\";","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/responses-api-proxy/src/read_api_key.rs#L198-L234","documentation":"After the Bearer prefix is stripped and newlines trimmed, validate_auth_header_bytes requires every remaining byte to be an ASCII letter, digit, '-' or '_' (equivalent to ^[A-Za-z0-9_-]+$). Any other character - quotes, dots, '+', '/', '=', spaces, NUL, or UTF-8 - fails validation, and read_auth_header_with zeroizes the buffer and returns this error.","triggerScenarios":"Piping a value with characters outside the whitelist: data containing literal quote characters, JWT-style tokens with dots, base64 values with +, /, or = padding, JSON objects, or any binary input.","commonSituations":"Keys wrapped in extra quoting so the quotes become part of the data; provider tokens using punctuation beyond hyphen/underscore; accidentally piping a config file; values with interior whitespace or tabs.","solutions":["Pipe the environment variable verbatim: printenv OPENAI_API_KEY | codex responses-api-proxy - no shell quoting artifacts","Validate first: [[ \"$OPENAI_API_KEY\" =~ ^[A-Za-z0-9_-]+$ ]] || exit 1","If the provider's key format uses other punctuation, it is unsupported by this proxy - transform it upstream or request support"],"exampleFix":"# before: quotes and dots are data\necho '\"sk-proj.abc123\"' | codex responses-api-proxy ...\n# after: raw [A-Za-z0-9_-]+ key\nprintenv OPENAI_API_KEY | codex responses-api-proxy ...","handlingStrategy":"validation","validationCode":"case \"$OPENAI_API_KEY\" in\n  ''|*[!A-Za-z0-9_-]*) echo 'key contains characters outside [A-Za-z0-9_-]' >&2; exit 1;;\nesac\nprintenv OPENAI_API_KEY | codex responses-api-proxy \"$@\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass keys via env/printenv rather than echo with added quoting","Add the regex check to wrapper scripts and CI pipelines","Remember the whitelist: alphanumerics, hyphen, underscore - nothing else"],"tags":["rust","api-key","validation","charset"],"backgroundTag":"api-key-validation-failed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}