warpdotdev/warp · error

--codex-auth-secret is only valid with --harness codex.

Error message

--codex-auth-secret is only valid with --harness codex.

What it means

Produced by RunCloudArgs::validate_auth_secrets (crates/warp_cli/src/agent.rs:678, surfaced at mod.rs:327): `--codex-auth-secret <NAME>` names a Warp-managed secret injected server-side into a codex-harness cloud agent, and is only valid with `--harness codex`. Since `--harness` defaults to Harness::Oz, passing the secret without switching the harness fails fast with this message.

Source

Thrown at app/src/ai/agent_sdk/mod.rs:327

            Ok(())
        }
        AgentCommand::RunCloud(args) => {
            if args.environment.environment.is_some()
                && !FeatureFlag::CloudEnvironments.is_enabled()
            {
                return Err(anyhow::anyhow!("unexpected argument '--environment' found"));
            }
            if args.conversation.is_some() && !FeatureFlag::CloudConversations.is_enabled() {
                return Err(anyhow::anyhow!(
                    "unexpected argument '--conversation' found"
                ));
            }
            if args.harness != Harness::Oz && !FeatureFlag::AgentHarness.is_enabled() {
                return Err(anyhow::anyhow!("unexpected argument '--harness' found"));
            }
            if let Err(msg) = args.validate_auth_secrets() {
                return Err(anyhow::anyhow!(msg));
            }
            if args.runner.is_some() && !FeatureFlag::CloudRunners.is_enabled() {
                return Err(anyhow::anyhow!("unexpected argument '--runner' found"));
            }
            ambient::run_ambient_agent(ctx, args)
        }
        AgentCommand::Profile(sub) => profiles::run(ctx, global_options, sub),
        AgentCommand::List(args) => {
            agent_management::list_agents(ctx, global_options.output_format, args)
        }
        AgentCommand::Get(args) => {
            agent_management::get_agent(ctx, global_options.output_format, args)
        }
        AgentCommand::Create(args) => {
            agent_management::create_agent(ctx, global_options.output_format, args)
        }
        AgentCommand::Update(args) => {
            agent_management::update_agent(ctx, global_options.output_format, args)

View on GitHub (pinned to e72fd7aacb)

Solutions

1. Add `--harness codex` to the same invocation
2. If you meant claude, use `--harness claude --claude-auth-secret` instead
3. Create the secret first if needed: `oz secret create codex api-key <NAME>`

Example fix

# before
$ oz agent run-cloud --codex-auth-secret my-key "task"
Error: --codex-auth-secret is only valid with --harness codex.

# after
$ oz agent run-cloud --harness codex --codex-auth-secret my-key "task"

let ok = args.codex_auth_secret.is_none() || args.harness == Harness::Codex;
anyhow::ensure!(ok, "--codex-auth-secret requires --harness codex");

pub fn codex_secret_ok(args: &RunCloudArgs) -> bool {
    args.codex_auth_secret.is_none() || args.harness == Harness::Codex
}

match run_agent(ctx, opts, cmd) {
    Err(e) if e.to_string().starts_with("--codex-auth-secret") => {
        // re-invoke with --harness codex added
    }
    result => result?,
}

When it happens

Trigger: Running `agent run-cloud --codex-auth-secret NAME ...` with any harness other than exactly `codex` (the oz default included). Pure argument-pairing check; fires before auth-secrets validation of the runner launch.

Common situations: Migrating a claude-harness invocation to codex and changing only the secret flag; scripts templating one secret flag for all harnesses; forgetting that the harness default is oz.

Related errors

• --claude-auth-secret is only valid with --harness claude.
• invalid value 'secret'
• invalid value 'harness-support'
• unexpected argument '--harness' found
• The opencode harness is only supported for local child agent

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/b59d153191f4aefd. Report an issue: GitHub.