router-for-me/CLIProxyAPI · error

invalid_realtime_client_secret

invalid_realtime_client_secret

Error message

Realtime client secret is invalid or expired

What it means

Returned when the model stream bridge cannot hand out a stream ID: either h.modelStreams is nil (bridge never created) or open() failed. The bridge maps StreamIDs to chunk channels plus cancel funcs so the plugin can read the model stream incrementally; without an ID the just-started upstream stream is cancelled and the callback aborts.

Source

Thrown at internal/client/codex/live/client_secret.go:31

	"time"

	"github.com/gin-gonic/gin"
)

const (
	ClientSecretSessionContextKey   = "codexLiveClientSecretSession"
	ClientSecretPrincipalContextKey = "codexLiveClientSecretPrincipal"
	clientSecretPrefix              = "ek_"
	clientSecretDefaultLifetime     = 10 * time.Minute
	clientSecretMinimumLifetime     = 10 * time.Second
	clientSecretMaximumLifetime     = 2 * time.Hour
	clientSecretMaxBodySize         = 64 << 10
	clientSecretMaxEntries          = 1024
	clientSecretMaxEntriesPerIssuer = 64
)

var (
	errInvalidClientSecret    = errors.New("Realtime client secret is invalid or expired")
	errClientSecretCapacity   = errors.New("Realtime client secret capacity exhausted")
	errUnsupportedSessionType = errors.New("Realtime session type is not supported")
)

// ClientSecretAuthorization contains the local session configuration associated with an ephemeral key.
type ClientSecretAuthorization struct {
	Principal       string
	IssuerPrincipal string
	IssuerProvider  string
	Session         json.RawMessage
}

type clientSecretEntry struct {
	authorization ClientSecretAuthorization
	expiresAt     time.Time
}

type clientSecretStore struct {

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Construct the Host through the SDK builder/entrypoint (sdk/cliproxy) so all bridges, including modelStreams, are initialized.
2. If building a Host manually, initialize the model stream bridge field before loading plugins.
3. Avoid issuing host.model.execute_stream during host shutdown; gate plugin callbacks on a readiness flag.

resp, err := host.Call(ctx, "host.model.execute_stream", raw)
if err != nil {
    if strings.Contains(err.Error(), "stream bridge is unavailable") {
        return errors.New("host misconfigured: model stream bridge not initialized")
    }
    return err
}

When it happens

Trigger: Host constructed without the model stream bridge (partial initialization, some test harnesses), or open() returning "" because the bridge is closed/shut down while a plugin initiates host.model.execute_stream.

Common situations: Embedding the SDK but constructing the plugin Host manually without the full builder; host shutdown racing a plugin's model call; a fork of the host code that skips bridge creation.

Related errors

• invalid_expires_after
• count must be a positive integer
• Codex live multipart body requires an sdp field
• Codex live call request requires an SDP offer
• core auth manager unavailable

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/f7e62d786ee524fd. Report an issue: GitHub.