stablyai/orca · error · Error

Codex login completed, but Orca could not resolve the accoun

Error message

Codex login completed, but Orca could not resolve the account email.

What it means

Thrown by persistCapturedCodexAccount after doAddAccount / doAddAccountFromHome. readIdentityFromHome successfully read auth.json and parsed the OAuth credentials, but resolveIdentityFromCredentials (service.ts:1799) could not extract an email from the id_token JWT claims (no top-level 'email' and no email in the profile claim namespace). Orca keys managed accounts by email, so it refuses to persist an account without one.

Source

Thrown at src/main/codex-accounts/service.ts:784

    const authPath = join(resolve(trimmed), 'auth.json')
    if (!existsSync(authPath)) {
      throw new Error(
        `No Codex credentials found in ${resolve(trimmed)}. Run \`codex login\` into this directory first.`
      )
    }
    const trustedHome = this.assertManagedHomePath(managedHomePath, accountId)
    writeFileAtomically(join(trustedHome, 'auth.json'), readFileSync(authPath, 'utf-8'), {
      mode: 0o600
    })
  }

  private async persistCapturedCodexAccount(
    accountId: string,
    managedHome: ManagedHomeLocation
  ): Promise<CodexRateLimitAccountsState> {
    const identity = this.readIdentityFromHome(managedHome.managedHomePath, accountId)
    if (!identity.email) {
      throw new Error('Codex login completed, but Orca could not resolve the account email.')
    }

    const now = Date.now()
    const account: CodexManagedAccount = {
      id: accountId,
      email: identity.email,
      managedHomePath: managedHome.managedHomePath,
      managedHomeRuntime: managedHome.managedHomeRuntime,
      wslDistro: managedHome.wslDistro,
      wslLinuxHomePath: managedHome.wslLinuxHomePath,
      providerAccountId: identity.providerAccountId,
      workspaceLabel: identity.workspaceLabel,
      workspaceAccountId: identity.workspaceAccountId,
      createdAt: now,
      updatedAt: now,
      lastAuthenticatedAt: now
    }

View on GitHub (pinned to 1136503c6a)

Solutions

  1. Re-authenticate ensuring the email scope is granted; re-run `codex login` (or re-trigger addAccount) so a token with an email claim is issued.
  2. Inspect the id_token in the managed home's auth.json (JWT payload) to confirm whether an email claim is present; if not, the account type/provider config is the cause.
  3. If the token genuinely has no email, Orca cannot manage this identity — use the system-default account instead.
Defensive patterns

Strategy: try-catch

Validate before calling

// Decode the id_token email claim before persisting (best-effort pre-check).
function idTokenHasEmail(authJson: string): boolean {
  try {
    const idToken = JSON.parse(authJson).id_token ?? JSON.parse(authJson).idToken
    const payload = JSON.parse(Buffer.from(idToken.split('.')[1], 'base64').toString('utf-8'))
    return Boolean(payload.email ?? payload['https://api.openai.com/profile']?.email)
  } catch { return false }
}

Try / catch

try {
  await service.addAccount(target)
} catch (error) {
  if (error instanceof Error && error.message.includes('could not resolve the account email')) {
    // prompt re-login; the issued token lacked the email claim
  } else throw error
}

Prevention

When it happens

Trigger: codex login completed and wrote auth.json, but the issued id_token lacks an email claim. Reached via addAccount() (service.ts:728) or addAccountFromHome() (service.ts:747).

Common situations: The OAuth provider issued a token without an email scope/claim (e.g. a service/workspace account, SSO with email hidden, or an atypical ChatGPT workspace token). A corrupt or partial auth.json can also yield empty identity fields.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/a07cb86195928bd1. Report an issue: GitHub.