zeroclaw-labs/zeroclaw · warning · DiagItem

OpenAI slot(s) {$slots} set `requires_openai_auth = true` bu

Error message

OpenAI slot(s) {$slots} set `requires_openai_auth = true` but no OpenAI Codex credentials are signed in. Run `zeroclaw auth login --provider openai-codex`.

What it means

Inverse case of the Codex wiring check: one or more provider slots opt into OpenAI Codex auth (`requires_openai_auth = true`, listed in `{slots}`) but no Codex credential profile is signed in. The first model call through such a slot will fail authentication, so doctor warns before that happens.

Source

Thrown at crates/zeroclaw-runtime/src/doctor/mod.rs:197

        .providers
        .models
        .openai
        .iter()
        .filter(|(_, cfg)| cfg.base.requires_openai_auth)
        .map(|(alias, _)| format!("openai.{alias}"))
        .collect();

    let mut items = Vec::new();
    match (codex_profile_present, auth_slots.is_empty()) {
        // Credential imported, but nothing references it — silent until the
        // operator wires a slot and points an agent at it.
        (true, true) => items.push(DiagItem::warn(
            CAT,
            crate::i18n::get_required_cli_string("cli-doctor-codex-auth-profile-no-slot"),
        )),
        // Slot opts into Codex auth, but no credential is signed in — fails at
        // the first model call.
        (false, false) => items.push(DiagItem::warn(
            CAT,
            crate::i18n::get_required_cli_string_with_args(
                "cli-doctor-codex-auth-slot-no-profile",
                &[("slots", &auth_slots.join(", "))],
            ),
        )),
        // Both present — wiring is consistent.
        (true, false) => items.push(DiagItem::ok(
            CAT,
            crate::i18n::get_required_cli_string("cli-doctor-codex-auth-ok"),
        )),
        // Codex unused on both sides — stay silent (no noise for users who
        // never touch Codex).
        (false, true) => {}
    }
    items
}

View on GitHub (pinned to 88bb9c8533)

Solutions

Run `zeroclaw auth login --provider openai-codex` to sign in the credentials
Or remove `requires_openai_auth = true` from the listed slots and use a plain api_key instead
Re-run `zeroclaw doctor` to confirm the warning clears

Example fix

# before
[providers.openai]
requires_openai_auth = true   # but no credentials signed in

# after (option A): sign in
# $ zeroclaw auth login --provider openai-codex

# after (option B): use an API key
[providers.openai]
api_key = "sk-..."

Defensive patterns

Strategy: validation

Validate before calling

if zeroclaw doctor | grep -q 'requires_openai_auth'; then
  echo 'sign in with: zeroclaw auth login --provider openai-codex (or drop the flag)'
  exit 1
fi

Prevention

Run `zeroclaw auth login --provider openai-codex` on every machine whose config sets requires_openai_auth
Drop the flag on slots that use plain api_key auth

When it happens

Trigger: Config enables `requires_openai_auth = true` on OpenAI slots before or without running `zeroclaw auth login --provider openai-codex`, or the credential profile was removed/expired.

Common situations: Config deployed to a new machine without importing credentials; credentials signed in a different user account; experiments with the flag left enabled.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/5514da79ce4af775. Report an issue: GitHub.