Codex OAuth credential is missing a ChatGPT account id

Error message

Codex OAuth credential is missing a ChatGPT account id

What it means

Inside withOAuthAccess, each attempt derives the ChatGPT account id from the access token (or the access object). Codex's backend requires the chatgpt-account-id header; if a refreshed/rotated credential yields no account id (neither access.accountId nor extractable from the bearer token), searchCodex throws a plain Error because the request cannot be authenticated correctly.

Source

Thrown at packages/coding-agent/src/web/search/providers/codex.ts:809

			},
		);
	} else {
		const seed = await findCodexAuth(params.authStorage, params.sessionId, params.signal);
		if (!seed) {
			throw new Error(
				"No Codex OAuth credentials found. Login with 'omp /login openai-codex' to enable Codex web search.",
			);
		}

		result = await withOAuthAccess(
			params.authStorage,
			"openai-codex",
			access => {
				// A refreshed/rotated credential can carry a different bearer and
				// ChatGPT account id than the seed used to select the first attempt.
				const accountId = access.accountId ?? getCodexAccountId(access.accessToken);
				if (!accountId) {
					throw new Error("Codex OAuth credential is missing a ChatGPT account id");
				}
				return runCodexSearchCandidates({
					auth: { accessToken: access.accessToken, accountId },
					params,
					query,
					modelCandidates,
					modelWasConfigured: configuredModel !== undefined,
					transport,
				});
			},
			{ sessionId: params.sessionId, signal: params.signal, seed: seed.access },
		);
	}

	let sources = result.sources;

	const numResults = params.numSearchResults ?? params.limit;
	if (numResults && sources.length > numResults) {

View on GitHub (pinned to 9690622007)

Solutions

Re-login with `omp /login openai-codex` to obtain a fresh token containing account-id claims.
Delete the stale openai-codex entry in auth storage and authenticate again.
Check for a package update if OpenAI changed the token claim structure (getCodexAccountId parsing).
Ensure no manual edits/injections replaced the stored access token with a non-ChatGPT bearer.

Example fix

// before
# auth.json contains token copied from another OpenAI client (no chatgpt account claim)
// after
$ rm ~/.omp/auth/openai-codex.json && omp /login openai-codex

Defensive patterns

Strategy: try-catch

Validate before calling

function tokenHasAccountId(token: string): boolean {
  try {
    const claims = JSON.parse(atob(token.split(".")[1]));
    return Boolean(claims["chatgpt_account_id"]);
  } catch { return false; }
}

Type guard

function isMissingAccountIdError(e: unknown): e is Error {
  return e instanceof Error && e.message === "Codex OAuth credential is missing a ChatGPT account id";
}

Try / catch

try {
  return await searchCodex(params);
} catch (e) {
  if (isMissingAccountIdError(e)) {
    await relogin("openai-codex");
    return searchCodex(params);
  }
  throw e;
}

Prevention

Never hand-edit auth storage tokens; always obtain them via `omp /login openai-codex`.
Re-login after any error mentioning rotated/refreshed credentials.
Watch for OpenAI token format changes and update the package promptly.

When it happens

Trigger: The OAuth access token obtained (including after mid-search refresh/rotation) lacks an accountId field AND getCodexAccountId(accessToken) fails to decode an account id from the JWT claims — typically a malformed, non-ChatGPT, or structurally changed token.

Common situations: Auth storage holding a hand-copied or truncated access token; token issued to a non-ChatGPT OAuth client; upstream token format change after an OpenAI update; corrupted auth.json.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/3e208c79fa8918d6. Report an issue: GitHub.