mastra-ai/mastra · error · ProviderAuthRequiredError

Not logged in to OpenAI Codex.

Error message

Not logged in to OpenAI Codex.

What it means

getCodexBearer resolves the OpenAI Codex OAuth bearer token used by both the agent fetch and the Stagehand fetch. It reloads the credential store and requires an 'openai-codex' credential of type 'oauth'. If absent or of another type, it throws ProviderAuthRequiredError('Not logged in to OpenAI Codex.').

Source

Thrown at mastracode/sdk/src/providers/openai-codex.ts:135

 * Get a live OAuth bearer token for the Codex OAuth credential.
 *
 * Refreshes the token if it's expired, and returns the credential's
 * accountId alongside the access token. Throws if the user isn't logged in
 * or if the refresh fails.
 *
 * This is the only piece of Codex auth that is genuinely shared between
 * the main agent's fetch (`buildOpenAICodexOAuthFetch`) and the Stagehand
 * fetch (`buildCodexStagehandFetch`).
 */
async function getCodexBearer(
  authStorage?: CredentialStore,
): Promise<{ accessToken: string; accountId: string | undefined }> {
  const storage = authStorage ?? getAuthStorage();
  storage.reload();

  const cred = storage.get('openai-codex');
  if (!cred || cred.type !== 'oauth') {
    throw new ProviderAuthRequiredError('Not logged in to OpenAI Codex.');
  }

  let accessToken = cred.access;
  if (Date.now() >= cred.expires) {
    const refreshedToken = await storage.getApiKey('openai-codex');
    if (!refreshedToken) {
      throw new ProviderAuthRequiredError('Failed to refresh the OpenAI Codex token.');
    }
    accessToken = refreshedToken;
    storage.reload();
  }

  return { accessToken, accountId: (cred as any).accountId as string | undefined };
}

/**
 * Build a fetch function that handles OpenAI Codex OAuth.
 * Preserves non-authorization headers from init.

View on GitHub (pinned to 75dd419e61)

Solutions

1. Run the OpenAI Codex OAuth login flow to store the 'openai-codex' oauth credential.
2. Verify the credentials store contains an 'openai-codex' entry with type 'oauth'.
3. If using a custom authStorage (opts.authStorage), populate it or point it at the real credential store.
4. Confirm you are not overwriting the entry with an api-key type credential elsewhere in your setup.

Example fix

// before
const fetch = buildOpenAICodexOAuthFetch(); // throws when not logged in
// after
if (!authStorage.get('openai-codex') || authStorage.get('openai-codex').type !== 'oauth') {
  await codexLogin(); // OAuth device/browser flow
}
const fetch = buildOpenAICodexOAuthFetch({ authStorage });

const cred = storage.get('openai-codex');
if (!cred || cred.type !== 'oauth') {
  throw new Error('OpenAI Codex login required; run the Codex OAuth flow first');
}

function isCodexOAuthCred(c: unknown): c is { type: 'oauth'; access: string; expires: number } {
  return !!c && typeof c === 'object' && (c as any).type === 'oauth' &&
    typeof (c as any).access === 'string' && typeof (c as any).expires === 'number';
}

try {
  return await codexFetch(url, init);
} catch (e) {
  if (e instanceof ProviderAuthRequiredError && /Not logged in/.test(e.message)) {
    await codexLogin();
    return await codexFetch(url, init);
  }
  throw e;
}

When it happens

Trigger: Any request via buildOpenAICodexOAuthFetch or buildCodexStagehandFetch when the credential store has no 'openai-codex' entry or that entry's type is not 'oauth' (e.g. api-key credential, null after reload).

Common situations: User never ran the Codex OAuth login; credentials cleared or logged out; a ChatGPT/API-key credential stored under 'openai-codex' so the type check fails; CI environment without the credentials file; passing an empty custom authStorage.

Related errors

• Not logged in to Kimi For Coding.
• Failed to refresh the OpenAI Codex token.
• Not logged in to xAI.
• State token has expired
• Redirect URI is required for SSO login

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/a6df976d4783b585. Report an issue: GitHub.