openai/codex · error · WorkloadIdentityError

the workload identity token URL must use HTTPS or loopback H

Error message

the workload identity token URL must use HTTPS or loopback HTTP

What it means

Error "the workload identity token URL must use HTTPS or loopback HTTP" thrown in openai/codex.

Source

Thrown at codex-rs/workload-identity/src/lib.rs:58

#[derive(Clone, Debug, Error)]
pub enum WorkloadIdentityError {
    #[error("the workload identity federation rule ID must not be empty")]
    InvalidFederationRuleId,
    #[error("the workload identity assertion file path must be absolute")]
    AssertionFileMustBeAbsolute,
    #[error("the workload identity assertion is invalid")]
    InvalidAssertion,
    #[error("the workload identity assertion exceeds 16 KiB")]
    AssertionTooLarge,
    #[error("could not read workload identity assertion file {path}")]
    AssertionFile {
        path: PathBuf,
        #[source]
        source: Arc<std::io::Error>,
    },
    #[error("could not configure the workload identity HTTP client")]
    HttpClientConfiguration,
    #[error("the workload identity token URL must use HTTPS or loopback HTTP")]
    InvalidTokenUrl,
    #[error("the workload identity token exchange is unavailable")]
    ExchangeUnavailable,
    #[error("the workload identity token exchange was rejected with HTTP {0}")]
    ExchangeRejected(u16),
    #[error("the workload identity token exchange returned an invalid response")]
    InvalidExchangeResponse,
}

impl WorkloadIdentityError {
    /// Whether retrying the operation may succeed without changing configuration.
    pub fn is_transient(&self) -> bool {
        match self {
            Self::AssertionFile { source, .. } => matches!(
                source.kind(),
                std::io::ErrorKind::Interrupted
                    | std::io::ErrorKind::NotFound
                    | std::io::ErrorKind::TimedOut

View on GitHub (pinned to 339751715c)

Solutions

1. Use an HTTPS token URL, or loopback HTTP only for local development endpoints.

When it happens

Trigger: Thrown at codex-rs/workload-identity/src/lib.rs:58 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/65c811d65646d596. Report an issue: GitHub.