openai/codex · error · WorkloadIdentityError

the workload identity assertion exceeds 16 KiB

Error message

the workload identity assertion exceeds 16 KiB

What it means

Error "the workload identity assertion exceeds 16 KiB" thrown in openai/codex.

Source

Thrown at codex-rs/workload-identity/src/lib.rs:48

            return Err(WorkloadIdentityError::AssertionFileMustBeAbsolute);
        }
        Ok(Self {
            assertion_file,
            federation_rule_id: federation_rule_id.to_string(),
            workload_identity_context,
        })
    }
}

#[derive(Clone, Debug, Error)]
pub enum WorkloadIdentityError {
    #[error("the workload identity federation rule ID must not be empty")]
    InvalidFederationRuleId,
    #[error("the workload identity assertion file path must be absolute")]
    AssertionFileMustBeAbsolute,
    #[error("the workload identity assertion is invalid")]
    InvalidAssertion,
    #[error("the workload identity assertion exceeds 16 KiB")]
    AssertionTooLarge,
    #[error("could not read workload identity assertion file {path}")]
    AssertionFile {
        path: PathBuf,
        #[source]
        source: Arc<std::io::Error>,
    },
    #[error("could not configure the workload identity HTTP client")]
    HttpClientConfiguration,
    #[error("the workload identity token URL must use HTTPS or loopback HTTP")]
    InvalidTokenUrl,
    #[error("the workload identity token exchange is unavailable")]
    ExchangeUnavailable,
    #[error("the workload identity token exchange was rejected with HTTP {0}")]
    ExchangeRejected(u16),
    #[error("the workload identity token exchange returned an invalid response")]
    InvalidExchangeResponse,
}

View on GitHub (pinned to 339751715c)

Solutions

1. Reduce the assertion size below 16 KiB; use a standard signed JWT rather than an oversized or concatenated payload.

When it happens

Trigger: Thrown at codex-rs/workload-identity/src/lib.rs:48 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/269c55fccdca6257. Report an issue: GitHub.