openai/codex · error · anyhow::Error

API key must be provided via stdin (e.g. printenv OPENAI_API

Error message

API key must be provided via stdin (e.g. printenv OPENAI_API_KEY | codex responses-api-proxy)

What it means

After reading stdin and trimming trailing CR/LF, if nothing remains beyond the 'Bearer ' prefix the key is empty and read_auth_header_with fails with this hint. Both an immediate EOF (empty stdin) and newline/whitespace-only input trigger it.

Source

Thrown at codex-rs/responses-api-proxy/src/read_api_key.rs:135

        // Continue loop; if buffer fills without newline/EOF we'll error below.
    }

    // If buffer filled and we did not see newline or EOF, error out.
    if total_read == capacity && !saw_newline && !saw_eof {
        buf.zeroize();
        return Err(anyhow!(
            "API key is too large to fit in the {BUFFER_SIZE}-byte buffer"
        ));
    }

    let mut total = prefix_len + total_read;
    while total > prefix_len && (buf[total - 1] == b'\n' || buf[total - 1] == b'\r') {
        total -= 1;
    }

    if total == AUTH_HEADER_PREFIX.len() {
        buf.zeroize();
        return Err(anyhow!(
            "API key must be provided via stdin (e.g. printenv OPENAI_API_KEY | codex responses-api-proxy)"
        ));
    }

    if let Err(err) = validate_auth_header_bytes(&buf[AUTH_HEADER_PREFIX.len()..total]) {
        buf.zeroize();
        return Err(err);
    }

    let header_str = match std::str::from_utf8(&buf[..total]) {
        Ok(value) => value,
        Err(err) => {
            // In theory, validate_auth_header_bytes() should have caught
            // any invalid UTF-8 sequences, but just in case...
            buf.zeroize();
            return Err(err).context("reading Authorization header from stdin as UTF-8");
        }
    };

View on GitHub (pinned to 339751715c)

Solutions

1. Pipe the key explicitly: printenv OPENAI_API_KEY | codex responses-api-proxy --upstream-url ...
2. Verify the variable first: test -n "$OPENAI_API_KEY" || exit 1
3. In CI, export the secret before the step that launches the proxy

Example fix

# before: stdin empty/EOF
codex responses-api-proxy --upstream-url http://localhost:3000
# after
printenv OPENAI_API_KEY | codex responses-api-proxy --upstream-url http://localhost:3000

if [ -z "${OPENAI_API_KEY:-}" ]; then echo 'OPENAI_API_KEY not set or empty' >&2; exit 1; fi
printenv OPENAI_API_KEY | codex responses-api-proxy "$@"

When it happens

Trigger: Running 'codex responses-api-proxy' without piping anything (stdin already at EOF - common in cron, CI, or detached sessions), piping an unset variable, or piping only blank lines.

Common situations: Forgetting the pipe in scripts; OPENAI_API_KEY unset so printenv emits nothing; CI steps with stdin closed to /dev/null; running under nohup without stdin redirection.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

• API key is too large to fit in the {BUFFER_SIZE}-byte buffer
• API key may only contain ASCII letters, numbers, '-' or '_'
• Unsupported platform: ${platform} (${arch})
• Unsupported target triple: ${targetTriple}
• Missing optional dependency ${platformPackage}. Reinstall Co

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/b19f73a92ca81b02. Report an issue: GitHub.