openai/codex · error · anyhow::Error

`--ws-token-file` and `--ws-token-sha256` require `--ws-auth

Error message

`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`

What it means

Error "`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`" thrown in openai/codex.

Source

Thrown at codex-rs/app-server-transport/src/transport/auth.rs:174

                }
                let source = match (self.ws_token_file, self.ws_token_sha256) {
                    (Some(_), Some(_)) => {
                        anyhow::bail!(
                            "`--ws-token-file` and `--ws-token-sha256` are mutually exclusive"
                        );
                    }
                    (Some(token_file), None) => {
                        AppServerWebsocketCapabilityTokenSource::TokenFile {
                            token_file: absolute_path_arg("--ws-token-file", token_file)?,
                        }
                    }
                    (None, Some(token_sha256)) => {
                        AppServerWebsocketCapabilityTokenSource::TokenSha256 {
                            token_sha256: sha256_digest_arg("--ws-token-sha256", &token_sha256)?,
                        }
                    }
                    (None, None) => {
                        anyhow::bail!(
                            "`--ws-token-file` or `--ws-token-sha256` is required when `--ws-auth capability-token` is set"
                        );
                    }
                };
                Some(AppServerWebsocketAuthConfig::CapabilityToken { source })
            }
            Some(WebsocketAuthCliMode::SignedBearerToken) => {
                if self.ws_token_file.is_some() || self.ws_token_sha256.is_some() {
                    anyhow::bail!(
                        "`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`"
                    );
                }
                let shared_secret_file = self.ws_shared_secret_file.context(
                    "`--ws-shared-secret-file` is required when `--ws-auth signed-bearer-token` is set",
                )?;
                Some(AppServerWebsocketAuthConfig::SignedBearerToken {
                    shared_secret_file: absolute_path_arg(
                        "--ws-shared-secret-file",

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/app-server-transport/src/transport/auth.rs:174 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/415435bb1b8d0fe3. Report an issue: GitHub.