What causes "Codex Agent Identity credentials are incomplete" in jlcodes99/cockpit-tools?

Re-import or re-provision the account so agent_identity contains all four fields

Codex Agent Identity credentials are incomplete

Error message

Codex Agent Identity credentials are incomplete

What it means

buildAgentIdentityCredentials validates that a Codex account's agent_identity carries all four required fields — agent_runtime_id, agent_private_key, account_id, chatgpt_user_id — and throws when any is missing or blank. Without them an auth_mode='agentIdentity' credential document would be invalid.

Source

Thrown at src/utils/codexExportFormats.ts:271

  return normalizeTimestampToIso(accessExp);
}

function resolveLastRefresh(account: CodexAccount): string {
  return normalizeTimestampToIso(account.token_updated_at) || new Date().toISOString();
}

function hasAgentIdentity(account: CodexAccount): boolean {
  return Boolean(account.agent_identity?.agent_runtime_id?.trim());
}

function buildAgentIdentityCredentials(account: CodexAccount): JsonRecord {
  const identity = account.agent_identity;
  const agentRuntimeId = identity?.agent_runtime_id?.trim();
  const agentPrivateKey = identity?.agent_private_key?.trim();
  const accountId = identity?.account_id?.trim();
  const chatgptUserId = identity?.chatgpt_user_id?.trim();
  if (!agentRuntimeId || !agentPrivateKey || !accountId || !chatgptUserId) {
    throw new Error('Codex Agent Identity credentials are incomplete');
  }

  const credentials: JsonRecord = {
    auth_mode: 'agentIdentity',
    agent_runtime_id: agentRuntimeId,
    agent_private_key: agentPrivateKey,
    account_id: accountId,
    chatgpt_account_id: accountId,
    chatgpt_user_id: chatgptUserId,
    chatgpt_account_is_fedramp:
      identity?.chatgpt_account_is_fedramp === true,
  };
  const taskId = identity?.task_id?.trim();
  if (taskId) {
    credentials.task_id = taskId;
  }
  const email = identity?.email?.trim() || account.email?.trim();
  if (email) {

View on GitHub (pinned to 1ed8b77992)

Solutions

Re-import or re-provision the account so agent_identity contains all four fields
Verify the account actually uses Agent Identity auth mode before exporting
Skip agentIdentity accounts in the export selection
Check for trimming/serialization data loss in the import pipeline

Example fix

// before
const creds = toOfficialAuthJson(account); // throws if identity incomplete
// after
const id = account.agent_identity;
if (id?.agent_runtime_id?.trim() && id?.agent_private_key?.trim() && id?.account_id?.trim() && id?.chatgpt_user_id?.trim()) {
  const creds = toOfficialAuthJson(account);
}

Defensive patterns

Strategy: validation

Validate before calling

const id = account.agent_identity;
const ok = !!id?.agent_runtime_id?.trim() && !!id?.agent_private_key?.trim() &&
  !!id?.account_id?.trim() && !!id?.chatgpt_user_id?.trim();
if (!ok) throw new Error('agent identity incomplete');

Type guard

function hasCompleteAgentIdentity(a: CodexAccount): boolean {
  const id = a.agent_identity;
  return !!id?.agent_runtime_id?.trim() && !!id?.agent_private_key?.trim() &&
    !!id?.account_id?.trim() && !!id?.chatgpt_user_id?.trim();
}

Try / catch

try {
  const creds = buildSub2apiCredentials(account);
} catch (e) {
  if ((e as Error).message.includes('Agent Identity credentials are incomplete')) {
    // re-provision identity or skip account
  }
}

Prevention

Validate agent_identity completeness at import time
Only export accounts whose auth mode matches available credentials
Log which of the four fields is missing to speed diagnosis

When it happens

Trigger: Calling buildSub2apiCredentials, credentials, or toOfficialAuthJson on an account whose agent_identity is undefined or lacks any of the four trimmed fields.

Common situations: Account imported before Agent Identity fields were provisioned; partial export/import dropped identity fields; account is an OAuth/API-key account mistakenly exported in agentIdentity mode.

Related errors

AI-assisted analysis of jlcodes99/cockpit-tools@1ed8b77992 (2026-09-05). Data as JSON: /api/errors/c028de5dec2a8979. Report an issue: GitHub.