paperclipai/paperclip · error · Error

no Codex credentials provisioned for managed home "${input.e

Error message

no Codex credentials provisioned for managed home "${input.effectiveCodexHome}" (no usable auth.json, OPENAI_API_KEY is empty, and the sandbox has no Codex login). Use a sandbox image that is signed in to Codex, configure a per-agent OPENAI_API_KEY, or sign in to Codex on the host with a ChatGPT subscription.

What it means

Thrown by ensureCodexCredentialsProvisioned (execute.ts) for a SANDBOX transport target. It fires when credential readiness says the managed Codex home is not ready, the target is a sandbox, and probeSandboxCodexAuthJson returned a definitive "absent" (not "present", not "unknown"). The message lists the three ways to satisfy Codex auth because neither the host, the env, nor the sandbox has credentials.

Source

Thrown at packages/adapters/codex-local/src/server/execute.ts:400

      await input.onLog(
        "stdout",
        `Using the sandbox's own Codex login; managed home "${input.effectiveCodexHome}" has no host credentials.\n`,
      );
      return;
    }
    if (sandboxAuthJson === "unknown") {
      // The probe failing is an operational problem, not evidence that the
      // sandbox lacks a login — proceeding lets a genuinely credentialed
      // sandbox run, and a credential-less one still fails at Codex's first
      // request with the provider's own error.
      await input.onLog(
        "stderr",
        `Could not verify the sandbox's Codex login (probe failed); proceeding. ` +
          `If the sandbox has no credentials, Codex will fail at its first request.\n`,
      );
      return;
    }
    throw new Error(
      `no Codex credentials provisioned for managed home "${input.effectiveCodexHome}" ` +
        `(no usable auth.json, OPENAI_API_KEY is empty, and the sandbox has no Codex login). ` +
        `Use a sandbox image that is signed in to Codex, configure a per-agent OPENAI_API_KEY, ` +
        `or sign in to Codex on the host with a ChatGPT subscription.`,
    );
  }

  throw new Error(
    `no Codex credentials provisioned for managed home "${input.effectiveCodexHome}" ` +
      `(no usable auth.json and OPENAI_API_KEY is empty). ` +
      `Sign in to Codex on the host with a ChatGPT subscription, or configure a per-agent ` +
      `OPENAI_API_KEY.`,
  );
}

async function emitSandboxAuthPrecedenceWarningIfNeeded(input: {
  runId: string;
  target: MaybeResolvedExecutionTarget;

View on GitHub (pinned to 67001ec6eb)

Solutions

1. Build/use a sandbox image that is already signed in to Codex (auth.json baked in).
2. Configure a per-agent OPENAI_API_KEY in the agent's env so the run authenticates regardless of host/sandbox login state.
3. Sign in to Codex on the host with a ChatGPT subscription so the managed home auth.json is populated and copied into the sandbox.

// Before starting the sandbox run, assert at least one credential source exists.
function hasAnyCodexCredential(opts: { authJson: boolean; apiKey: string | undefined; sandboxSignedIn: boolean | "unknown" }): boolean {
  return opts.authJson || Boolean(opts.apiKey && opts.apiKey.trim()) || opts.sandboxSignedIn === true;
}

try {
  await ensureCodexCredentialsProvisioned(input);
} catch (e) {
  if (e instanceof Error && /no Codex credentials provisioned/.test(e.message)) {
    // surface a config UI error: prompt for OPENAI_API_KEY or a signed-in image, do not retry blindly
    return reportCredentialGap(e.message);
  }
  throw e;
}

When it happens

Trigger: evaluateCodexCredentialReadiness returns { managed: true, ready: false } (managed home set up but no usable auth.json and no OPENAI_API_KEY) AND target.kind==="remote" && target.transport==="sandbox" AND probeSandboxCodexAuthJson returns "absent".

Common situations: Fresh sandbox image that was never signed in to Codex; the host lost its ChatGPT-subscription login AND no per-agent OPENAI_API_KEY was configured AND the sandbox image has no baked-in auth.json.

Related errors

• no Codex credentials provisioned for managed home "${input.e
• Agent authentication failed
• Environment variable ${opts.apiKeyEnv.trim()} is not set
• Sandbox bridge mode requires a host-side Paperclip API token
• prepareSandboxManagedRuntime requires a client that exposes

AI-assisted analysis of paperclipai/paperclip@67001ec6eb (2026-08-12). Data as JSON: /api/errors/9318818a44831414. Report an issue: GitHub.