openai/codex · error · WorkloadIdentityError

the workload identity assertion is invalid

Error message

the workload identity assertion is invalid

What it means

Error "the workload identity assertion is invalid" thrown in openai/codex.

Source

Thrown at codex-rs/workload-identity/src/lib.rs:46

        }
        if !assertion_file.is_absolute() {
            return Err(WorkloadIdentityError::AssertionFileMustBeAbsolute);
        }
        Ok(Self {
            assertion_file,
            federation_rule_id: federation_rule_id.to_string(),
            workload_identity_context,
        })
    }
}

#[derive(Clone, Debug, Error)]
pub enum WorkloadIdentityError {
    #[error("the workload identity federation rule ID must not be empty")]
    InvalidFederationRuleId,
    #[error("the workload identity assertion file path must be absolute")]
    AssertionFileMustBeAbsolute,
    #[error("the workload identity assertion is invalid")]
    InvalidAssertion,
    #[error("the workload identity assertion exceeds 16 KiB")]
    AssertionTooLarge,
    #[error("could not read workload identity assertion file {path}")]
    AssertionFile {
        path: PathBuf,
        #[source]
        source: Arc<std::io::Error>,
    },
    #[error("could not configure the workload identity HTTP client")]
    HttpClientConfiguration,
    #[error("the workload identity token URL must use HTTPS or loopback HTTP")]
    InvalidTokenUrl,
    #[error("the workload identity token exchange is unavailable")]
    ExchangeUnavailable,
    #[error("the workload identity token exchange was rejected with HTTP {0}")]
    ExchangeRejected(u16),
    #[error("the workload identity token exchange returned an invalid response")]

View on GitHub (pinned to 339751715c)

Solutions

1. Regenerate or replace the assertion file with a valid token from the identity provider.

When it happens

Trigger: Thrown at codex-rs/workload-identity/src/lib.rs:46 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/311b14ee566bbc03. Report an issue: GitHub.