openai/codex · error · anyhow::Error

websocket auth flags require `--ws-auth capability-token` or

Error message

websocket auth flags require `--ws-auth capability-token` or `--ws-auth signed-bearer-token`

What it means

Error "websocket auth flags require `--ws-auth capability-token` or `--ws-auth signed-bearer-token`" thrown in openai/codex.

Source

Thrown at codex-rs/app-server-transport/src/transport/auth.rs:210

                        "--ws-shared-secret-file",
                        shared_secret_file,
                    )?,
                    issuer: normalize(self.ws_issuer),
                    audience: normalize(self.ws_audience),
                    max_clock_skew_seconds: self
                        .ws_max_clock_skew_seconds
                        .unwrap_or(DEFAULT_MAX_CLOCK_SKEW_SECONDS),
                })
            }
            None => {
                if self.ws_token_file.is_some()
                    || self.ws_token_sha256.is_some()
                    || self.ws_shared_secret_file.is_some()
                    || self.ws_issuer.is_some()
                    || self.ws_audience.is_some()
                    || self.ws_max_clock_skew_seconds.is_some()
                {
                    anyhow::bail!(
                        "websocket auth flags require `--ws-auth capability-token` or `--ws-auth signed-bearer-token`"
                    );
                }
                None
            }
        };

        Ok(AppServerWebsocketAuthSettings { config })
    }
}

pub fn policy_from_settings(
    settings: &AppServerWebsocketAuthSettings,
) -> io::Result<WebsocketAuthPolicy> {
    let mode = match settings.config.as_ref() {
        Some(AppServerWebsocketAuthConfig::CapabilityToken { source }) => match source {
            AppServerWebsocketCapabilityTokenSource::TokenFile { token_file } => {
                let token = read_trimmed_secret(token_file.as_ref())?;

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/app-server-transport/src/transport/auth.rs:210 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/6513c0651c5a5d47. Report an issue: GitHub.