openai/codex · error · anyhow::Error

`--ws-token-file` or `--ws-token-sha256` is required when `-

Error message

`--ws-token-file` or `--ws-token-sha256` is required when `--ws-auth capability-token` is set

What it means

Error "`--ws-token-file` or `--ws-token-sha256` is required when `--ws-auth capability-token` is set" thrown in openai/codex.

Source

Thrown at codex-rs/app-server-transport/src/transport/auth.rs:183

                            token_file: absolute_path_arg("--ws-token-file", token_file)?,
                        }
                    }
                    (None, Some(token_sha256)) => {
                        AppServerWebsocketCapabilityTokenSource::TokenSha256 {
                            token_sha256: sha256_digest_arg("--ws-token-sha256", &token_sha256)?,
                        }
                    }
                    (None, None) => {
                        anyhow::bail!(
                            "`--ws-token-file` or `--ws-token-sha256` is required when `--ws-auth capability-token` is set"
                        );
                    }
                };
                Some(AppServerWebsocketAuthConfig::CapabilityToken { source })
            }
            Some(WebsocketAuthCliMode::SignedBearerToken) => {
                if self.ws_token_file.is_some() || self.ws_token_sha256.is_some() {
                    anyhow::bail!(
                        "`--ws-token-file` and `--ws-token-sha256` require `--ws-auth capability-token`, not `signed-bearer-token`"
                    );
                }
                let shared_secret_file = self.ws_shared_secret_file.context(
                    "`--ws-shared-secret-file` is required when `--ws-auth signed-bearer-token` is set",
                )?;
                Some(AppServerWebsocketAuthConfig::SignedBearerToken {
                    shared_secret_file: absolute_path_arg(
                        "--ws-shared-secret-file",
                        shared_secret_file,
                    )?,
                    issuer: normalize(self.ws_issuer),
                    audience: normalize(self.ws_audience),
                    max_clock_skew_seconds: self
                        .ws_max_clock_skew_seconds
                        .unwrap_or(DEFAULT_MAX_CLOCK_SKEW_SECONDS),
                })
            }

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/app-server-transport/src/transport/auth.rs:183 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/d90807dc5a8fe4f5. Report an issue: GitHub.