openai/codex · error · anyhow::Error

API key is too large to fit in the {BUFFER_SIZE}-byte buffer

Error message

API key is too large to fit in the {BUFFER_SIZE}-byte buffer

What it means

The proxy reads the API key from stdin into a fixed 1024-byte stack buffer; after the 'Bearer ' prefix, 1017 bytes remain for the token. If the token region fills completely without a newline or EOF delimiting the key, read_auth_header_with zeroizes the buffer and returns this error rather than truncating silently.

Source

Thrown at codex-rs/responses-api-proxy/src/read_api_key.rs:123

        }

        // Search only the newly written region for a newline.
        let newly_written = &slice[..read];
        if let Some(pos) = newly_written.iter().position(|&b| b == b'\n') {
            total_read += pos + 1; // include the newline for trimming below
            saw_newline = true;
            break;
        }

        total_read += read;

        // Continue loop; if buffer fills without newline/EOF we'll error below.
    }

    // If buffer filled and we did not see newline or EOF, error out.
    if total_read == capacity && !saw_newline && !saw_eof {
        buf.zeroize();
        return Err(anyhow!(
            "API key is too large to fit in the {BUFFER_SIZE}-byte buffer"
        ));
    }

    let mut total = prefix_len + total_read;
    while total > prefix_len && (buf[total - 1] == b'\n' || buf[total - 1] == b'\r') {
        total -= 1;
    }

    if total == AUTH_HEADER_PREFIX.len() {
        buf.zeroize();
        return Err(anyhow!(
            "API key must be provided via stdin (e.g. printenv OPENAI_API_KEY | codex responses-api-proxy)"
        ));
    }

    if let Err(err) = validate_auth_header_bytes(&buf[AUTH_HEADER_PREFIX.len()..total]) {
        buf.zeroize();

View on GitHub (pinned to 339751715c)

Solutions

1. Pipe only the single-line key: printenv OPENAI_API_KEY | codex responses-api-proxy ...
2. Check the length first: test ${#OPENAI_API_KEY} -lt 1000
3. If keys longer than 1KB are genuinely required, raise BUFFER_SIZE in read_api_key.rs and rebuild

Example fix

# before: 1017+ bytes, no newline
cat credentials.json | codex responses-api-proxy --upstream-url http://localhost:3000
# after
printenv OPENAI_API_KEY | codex responses-api-proxy --upstream-url http://localhost:3000

#!/bin/sh
[ -n "$OPENAI_API_KEY" ] || { echo 'missing OPENAI_API_KEY' >&2; exit 1; }
[ "${#OPENAI_API_KEY}" -lt 1000 ] || { echo 'key exceeds the 1017-byte stdin buffer' >&2; exit 1; }
printenv OPENAI_API_KEY | codex responses-api-proxy "$@"

When it happens

Trigger: Piping 1017 or more bytes that contain no newline within the buffer window - for example cat'ing a PEM key, a .env file, or a JSON blob instead of a single-line API key.

Common situations: Piping the wrong file (certificate, credentials JSON, multi-line env dump) into the proxy; concatenating several values into one stream; hypothetical future tokens longer than 1KB.

Related errors

• API key must be provided via stdin (e.g. printenv OPENAI_API
• only user input can be added to the user-message queue
• queued user input exceeds the maximum length of {MAX_USER_IN
• memory import requires at least one selected memory
• failed to convert argv to CString: {err}

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/1991a2fe909516cb. Report an issue: GitHub.