jlcodes99/cockpit-tools · error

Official auth.json requires OPENAI_API_KEY for API Key accou

Error message

Official auth.json requires OPENAI_API_KEY for API Key accounts

What it means

toOfficialAuthJson throws this error when the account is classified as an API Key account (isCodexApiKeyAccount) but its openai_api_key is missing or blank. An official Codex auth.json with auth_mode='apikey' must contain a non-empty OPENAI_API_KEY.

Source

Thrown at src/utils/codexExportFormats.ts:537

    !refreshToken &&
    !hasAgentIdentity(account) &&
    !isCodexApiKeyAccount(account)
  );
}

function toOfficialAuthJson(account: CodexAccount): JsonRecord {
  if (hasAgentIdentity(account)) {
    return {
      auth_mode: 'agentIdentity',
      agent_identity: buildAgentIdentityCredentials(account),
      type: 'codex',
    };
  }

  if (isCodexApiKeyAccount(account)) {
    const apiKey = account.openai_api_key?.trim();
    if (!apiKey) {
      throw new Error('Official auth.json requires OPENAI_API_KEY for API Key accounts');
    }
    return {
      auth_mode: 'apikey',
      OPENAI_API_KEY: apiKey,
    };
  }

  const accessToken = account.tokens?.access_token?.trim() || '';
  if (!accessToken) {
    throw new Error('Official auth.json requires access_token');
  }

  if (isPersonalAccessTokenAccount(account)) {
    return {
      OPENAI_API_KEY: null,
      personal_access_token: accessToken,
      type: 'codex',
    };

View on GitHub (pinned to 1ed8b77992)

Solutions

1. Enter the OPENAI_API_KEY on the account before exporting auth.json
2. Fix the account's auth-type classification if it is wrongly tagged as API-key
3. Skip key-less API-key accounts in the export selection
4. Validate the key field when saving the account to prevent key-less API-key accounts

Example fix

// before
const auth = toOfficialAuthJson(account); // throws
// after
if (!isCodexApiKeyAccount(account) || account.openai_api_key?.trim()) {
  const auth = toOfficialAuthJson(account);
}

if (isCodexApiKeyAccount(account) && !account.openai_api_key?.trim()) {
  throw new Error('API key account missing OPENAI_API_KEY');
}

function isExportableApiKeyAccount(a: CodexAccount): boolean {
  return !isCodexApiKeyAccount(a) || !!a.openai_api_key?.trim();
}

try {
  const auth = toOfficialAuthJson(account);
} catch (e) {
  if ((e as Error).message.includes('requires OPENAI_API_KEY')) {
    // ask user to fill in the key
  }
}

When it happens

Trigger: Calling toOfficialAuthJson (export to official auth.json) on an account where isCodexApiKeyAccount(account) is true and openai_api_key trims to empty.

Common situations: Account typed as API-key during creation but key never filled in; key removed by an edit; account data imported from a source that omitted the key.

Related errors

• SUB2API_API_KEY_MISSING
• API_KEY_REQUIRED
• SUB2API_ACCESS_TOKEN_EXPIRY_MISSING
• Official auth.json requires access_token
• invalidJsonMessage

AI-assisted analysis of jlcodes99/cockpit-tools@1ed8b77992 (2026-09-05). Data as JSON: /api/errors/9c09e3daa139ea72. Report an issue: GitHub.