openai/codex · error · anyhow::Error

`--ws-token-file` and `--ws-token-sha256` are mutually exclu

Error message

`--ws-token-file` and `--ws-token-sha256` are mutually exclusive

What it means

Error "`--ws-token-file` and `--ws-token-sha256` are mutually exclusive" thrown in openai/codex.

Source

Thrown at codex-rs/app-server-transport/src/transport/auth.rs:159

                let trimmed = value.trim();
                (!trimmed.is_empty()).then(|| trimmed.to_string())
            })
        };

        let config = match self.ws_auth {
            Some(WebsocketAuthCliMode::CapabilityToken) => {
                if self.ws_shared_secret_file.is_some()
                    || self.ws_issuer.is_some()
                    || self.ws_audience.is_some()
                    || self.ws_max_clock_skew_seconds.is_some()
                {
                    anyhow::bail!(
                        "`--ws-shared-secret-file`, `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds` require `--ws-auth signed-bearer-token`"
                    );
                }
                let source = match (self.ws_token_file, self.ws_token_sha256) {
                    (Some(_), Some(_)) => {
                        anyhow::bail!(
                            "`--ws-token-file` and `--ws-token-sha256` are mutually exclusive"
                        );
                    }
                    (Some(token_file), None) => {
                        AppServerWebsocketCapabilityTokenSource::TokenFile {
                            token_file: absolute_path_arg("--ws-token-file", token_file)?,
                        }
                    }
                    (None, Some(token_sha256)) => {
                        AppServerWebsocketCapabilityTokenSource::TokenSha256 {
                            token_sha256: sha256_digest_arg("--ws-token-sha256", &token_sha256)?,
                        }
                    }
                    (None, None) => {
                        anyhow::bail!(
                            "`--ws-token-file` or `--ws-token-sha256` is required when `--ws-auth capability-token` is set"
                        );
                    }

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/app-server-transport/src/transport/auth.rs:159 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/e72e5954b15dcc78. Report an issue: GitHub.