paperclipai/paperclip · error · Error

no Codex credentials provisioned for managed home "${input.e

Error message

no Codex credentials provisioned for managed home "${input.effectiveCodexHome}" (no usable auth.json and OPENAI_API_KEY is empty). Sign in to Codex on the host with a ChatGPT subscription, or configure a per-agent OPENAI_API_KEY.

What it means

Thrown by ensureCodexCredentialsProvisioned for a NON-sandbox target (the else branch at execute.ts:408). It fires when the managed Codex home is not ready and the target is not a sandbox, so there is no sandbox login to fall back on. The message is shorter than 384 because there is no third (sandbox) remediation path.

Source

Thrown at packages/adapters/codex-local/src/server/execute.ts:408

      // sandbox lacks a login — proceeding lets a genuinely credentialed
      // sandbox run, and a credential-less one still fails at Codex's first
      // request with the provider's own error.
      await input.onLog(
        "stderr",
        `Could not verify the sandbox's Codex login (probe failed); proceeding. ` +
          `If the sandbox has no credentials, Codex will fail at its first request.\n`,
      );
      return;
    }
    throw new Error(
      `no Codex credentials provisioned for managed home "${input.effectiveCodexHome}" ` +
        `(no usable auth.json, OPENAI_API_KEY is empty, and the sandbox has no Codex login). ` +
        `Use a sandbox image that is signed in to Codex, configure a per-agent OPENAI_API_KEY, ` +
        `or sign in to Codex on the host with a ChatGPT subscription.`,
    );
  }

  throw new Error(
    `no Codex credentials provisioned for managed home "${input.effectiveCodexHome}" ` +
      `(no usable auth.json and OPENAI_API_KEY is empty). ` +
      `Sign in to Codex on the host with a ChatGPT subscription, or configure a per-agent ` +
      `OPENAI_API_KEY.`,
  );
}

async function emitSandboxAuthPrecedenceWarningIfNeeded(input: {
  runId: string;
  target: MaybeResolvedExecutionTarget;
  cwd: string;
  configuredApiKey: boolean;
  hostAuthJson: boolean;
  onLog: AdapterExecutionContext["onLog"];
  onEvent: AdapterExecutionContext["onEvent"];
}): Promise<void> {
  if (!input.target || input.target.kind !== "remote" || input.target.transport !== "sandbox") {
    return;

View on GitHub (pinned to 67001ec6eb)

Solutions

1. Run `codex login` on the host with a ChatGPT subscription to populate the managed home auth.json.
2. Set a per-agent OPENAI_API_KEY env var for the run.
3. If using a shared/team key, configure it in the agent's env block rather than relying on a host login.

function localCodexReady(env: NodeJS.ProcessEnv, authJsonExists: boolean): boolean {
  return authJsonExists || Boolean(env.OPENAI_API_KEY && env.OPENAI_API_KEY.trim());
}

try {
  await ensureCodexCredentialsProvisioned(input);
} catch (e) {
  if (e instanceof Error && /no Codex credentials provisioned/.test(e.message)) {
    // prompt operator to run `codex login` or set OPENAI_API_KEY; non-retryable config error
  }
  throw e;
}

When it happens

Trigger: evaluateCodexCredentialReadiness returns { managed: true, ready: false } AND the target is NOT (kind==="remote" && transport==="sandbox") — i.e. a local/remote-non-sandbox run.

Common situations: Local Codex run on a machine where the user never ran `codex login` and OPENAI_API_KEY is unset; the managed home auth.json was deleted or expired and the subscription login was not refreshed.

Related errors

• no Codex credentials provisioned for managed home "${input.e
• Agent authentication failed
• Environment variable ${opts.apiKeyEnv.trim()} is not set
• In-place workspace realization requires the Codex CLI engine
• chatgpt wham api returned ${resp.status}

AI-assisted analysis of paperclipai/paperclip@67001ec6eb (2026-08-12). Data as JSON: /api/errors/2efaf302c742e41a. Report an issue: GitHub.