openai/codex · error · anyhow::Error

CODEX_ACCESS_TOKEN did not provide permitted Agent Identity

Error message

CODEX_ACCESS_TOKEN did not provide permitted Agent Identity authentication

What it means

Error "CODEX_ACCESS_TOKEN did not provide permitted Agent Identity authentication" thrown in openai/codex.

Source

Thrown at codex-rs/cli/src/main.rs:1987

    }
}

async fn load_exec_server_remote_auth_provider(
    config: &codex_core::config::Config,
    base_url: &str,
    use_agent_identity_auth: bool,
) -> anyhow::Result<codex_api::SharedAuthProvider> {
    if use_agent_identity_auth {
        read_codex_access_token_from_env().ok_or_else(|| {
            anyhow::anyhow!("CODEX_ACCESS_TOKEN is required when --use-agent-identity-auth is set")
        })?;
        let auth = AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ false)
            .await?
            .auth()
            .await
            .ok_or_else(|| anyhow::anyhow!("Agent Identity authentication is unavailable"))?;
        if !matches!(auth, CodexAuth::AgentIdentity(_)) {
            anyhow::bail!(
                "CODEX_ACCESS_TOKEN did not provide permitted Agent Identity authentication"
            );
        }
        return Ok(codex_model_provider::auth_provider_from_auth(&auth));
    }

    let (auth_manager, auth) = load_exec_server_remote_auth(
        config,
        "remote exec-server registration requires ChatGPT authentication or API key authentication; run `codex login` or set CODEX_API_KEY",
    )
    .await?;

    if !is_supported_exec_server_remote_auth(&auth) {
        anyhow::bail!(
            "remote exec-server registration requires ChatGPT authentication or API key authentication; Agent Identity auth requires --use-agent-identity-auth"
        );
    }

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/cli/src/main.rs:1987 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/cbc99c2bee6c0007. Report an issue: GitHub.