zeroclaw-labs/zeroclaw · warning · DiagItem

OpenAI Codex credentials are signed in but no model provider

Error message

OpenAI Codex credentials are signed in but no model provider slot uses them. Set `requires_openai_auth = true` on an OpenAI provider slot and point an agent's `model_provider` at it, or run `zeroclaw quickstart`.

What it means

Doctor's Codex wiring check pairs two facts: an OpenAI Codex credential profile is signed in, and at least one provider slot sets `requires_openai_auth = true`. This warning is the first mismatch case — credentials exist but no slot references them, so they will never be used. It is advisory: auth will silently not apply to any provider.

Source

Thrown at crates/zeroclaw-runtime/src/doctor/mod.rs:191

}

fn codex_auth_wiring_items(codex_profile_present: bool, config: &Config) -> Vec<DiagItem> {
    const CAT: &str = "providers.auth";

    let auth_slots: Vec<String> = config
        .providers
        .models
        .openai
        .iter()
        .filter(|(_, cfg)| cfg.base.requires_openai_auth)
        .map(|(alias, _)| format!("openai.{alias}"))
        .collect();

    let mut items = Vec::new();
    match (codex_profile_present, auth_slots.is_empty()) {
        // Credential imported, but nothing references it — silent until the
        // operator wires a slot and points an agent at it.
        (true, true) => items.push(DiagItem::warn(
            CAT,
            crate::i18n::get_required_cli_string("cli-doctor-codex-auth-profile-no-slot"),
        )),
        // Slot opts into Codex auth, but no credential is signed in — fails at
        // the first model call.
        (false, false) => items.push(DiagItem::warn(
            CAT,
            crate::i18n::get_required_cli_string_with_args(
                "cli-doctor-codex-auth-slot-no-profile",
                &[("slots", &auth_slots.join(", "))],
            ),
        )),
        // Both present — wiring is consistent.
        (true, false) => items.push(DiagItem::ok(
            CAT,
            crate::i18n::get_required_cli_string("cli-doctor-codex-auth-ok"),
        )),
        // Codex unused on both sides — stay silent (no noise for users who

View on GitHub (pinned to 88bb9c8533)

Solutions

Set `requires_openai_auth = true` on an OpenAI provider slot and point an agent's `model_provider` at it
Or run `zeroclaw quickstart` to generate the wiring automatically
Or ignore/sign out if you no longer intend to use Codex auth

Example fix

# before: credentials signed in, slot does not opt in
[providers.openai]
family = "openai"

# after
[providers.openai]
family = "openai"
requires_openai_auth = true

[agents.main]
model_provider = "openai"

Defensive patterns

Strategy: validation

Validate before calling

if zeroclaw doctor | grep -q 'Codex credentials are signed in'; then
  echo 'wire an OpenAI slot with requires_openai_auth = true before deploy'
  exit 1
fi

Prevention

Import Codex credentials and the provider slot wiring in the same change
Run `zeroclaw quickstart` to generate matching auth and provider config together

When it happens

Trigger: You signed in OpenAI Codex credentials (e.g. `zeroclaw auth login --provider openai-codex`) but no OpenAI provider slot has `requires_openai_auth = true`, or no agent's `model_provider` points at such a slot; check_codex_auth_wiring reports the warning.

Common situations: Quickstart credentials imported first, provider config wired later (or never); provider slots created from templates that omit the flag.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/463994d7fda6bb41. Report an issue: GitHub.