Honor configured proxy routes for auth refreshes (#34655)

## Why

ChatGPT token refresh requests need to follow the same configured routing policy as other authentication traffic, including environments that use the system proxy.

## What changed

- Require an `AuthRouteConfig` throughout login, logout, token refresh, personal access token, and agent identity flows.
- Build auth HTTP clients directly from that configuration instead of falling back to a default HTTP client when routing configuration is absent.

## Testing

- Add an integration test that refreshes a token through a cached system-proxy route and verifies the proxy receives the expected request.

GitOrigin-RevId: 7d54ab3219939a49921c51faf08cd4c2eabca51c

codex-rs/login/src/auth/agent_identity.rs

@@ -102,7 +102,7 @@ impl AgentIdentityAuth {
     pub async fn from_record(
         mut record: AgentIdentityAuthRecord,
         agent_identity_authapi_base_url: &str,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Self> {
         public_key_ssh_from_private_key_pkcs8_base64(&record.agent_private_key)
             .map_err(std::io::Error::other)?;
@@ -125,7 +125,7 @@ impl AgentIdentityAuth {
         jwt: &str,
         chatgpt_base_url: &str,
         agent_identity_authapi_base_url: &str,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Self> {
         let record = verified_record_from_jwt(jwt, chatgpt_base_url, auth_route_config).await?;
         Self::from_record(record, agent_identity_authapi_base_url, auth_route_config).await
@@ -175,7 +175,7 @@ pub(super) async fn register_managed_chatgpt_agent_identity(
     binding: ManagedChatGptAgentIdentityBinding,
     agent_identity_authapi_base_url: &str,
     session_source: SessionSource,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> std::io::Result<AgentIdentityAuth> {
     let key_material = generate_agent_key_material().map_err(std::io::Error::other)?;
     let registration_url = agent_registration_url(agent_identity_authapi_base_url);
@@ -222,7 +222,7 @@ pub(super) async fn register_managed_chatgpt_agent_identity(
 pub(super) async fn verified_record_from_jwt(
     jwt: &str,
     chatgpt_base_url: &str,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> std::io::Result<AgentIdentityAuthRecord> {
     AgentIdentityAuthRecord::from_agent_identity_jwt(jwt)?;
     let jwks_url = agent_identity_jwks_url(chatgpt_base_url);
@@ -302,7 +302,7 @@ where
 async fn register_task_for_record_with_retries(
     record: &AgentIdentityAuthRecord,
     agent_identity_authapi_base_url: &str,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> std::io::Result<String> {
     let task_registration_url =
         agent_task_registration_url(agent_identity_authapi_base_url, &record.agent_runtime_id);
@@ -392,7 +392,7 @@ mod tests {
         let auth = AgentIdentityAuth::from_record(
             agent_identity_record_with_generated_key(),
             &server.uri(),
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
         )
         .await?;
 
@@ -437,7 +437,7 @@ mod tests {
             &jwt,
             &format!("{}/backend-api", server.uri()),
             &server.uri(),
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
         )
         .await?;
 
@@ -480,7 +480,7 @@ mod tests {
         let auth = AgentIdentityAuth::from_record(
             agent_identity_record_with_generated_key(),
             &server.uri(),
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
         )
         .await?;
 

codex-rs/login/src/auth/auth_tests.rs

@@ -122,7 +122,7 @@ async fn login_with_access_token_writes_agent_identity_jwt() {
         /*forced_chatgpt_workspace_id*/ None,
         Some(&chatgpt_base_url),
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("login_with_access_token should succeed");
@@ -182,7 +182,7 @@ async fn stored_agent_identity_jwt_keeps_auth_json_unchanged() -> anyhow::Result
         Some(&chatgpt_base_url),
         AuthKeyringBackendKind::Direct,
         Some(&authapi_base_url),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await?
     .expect("auth should load");
@@ -228,7 +228,7 @@ async fn login_with_access_token_writes_only_personal_access_token() {
         Some(&allowed_workspaces),
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("personal access token login should succeed");
@@ -281,7 +281,7 @@ async fn login_with_access_token_rejects_personal_access_token_workspace_mismatc
         Some(&allowed_workspaces),
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect_err("personal access token workspace mismatch should fail");
@@ -314,7 +314,7 @@ async fn login_with_access_token_rejects_invalid_personal_access_token() {
         /*forced_chatgpt_workspace_id*/ None,
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect_err("invalid personal access token should fail");
@@ -338,7 +338,7 @@ async fn login_with_access_token_rejects_invalid_jwt() {
         /*forced_chatgpt_workspace_id*/ None,
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect_err("invalid access token should fail");
@@ -370,7 +370,7 @@ async fn chatgpt_auth_registers_agent_identity_when_enabled() -> anyhow::Result<
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await?
     .expect("auth should load");
@@ -380,7 +380,7 @@ async fn chatgpt_auth_registers_agent_identity_when_enabled() -> anyhow::Result<
             AgentIdentityAuthPolicy::JwtOnly,
             /*agent_identity_authapi_base_url*/ None,
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await?
@@ -411,7 +411,7 @@ async fn chatgpt_auth_registers_agent_identity_when_enabled() -> anyhow::Result<
             AgentIdentityAuthPolicy::ChatGptAuth,
             Some(&server.uri()),
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await?
@@ -421,7 +421,7 @@ async fn chatgpt_auth_registers_agent_identity_when_enabled() -> anyhow::Result<
             AgentIdentityAuthPolicy::ChatGptAuth,
             Some(&server.uri()),
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await?
@@ -452,7 +452,7 @@ async fn chatgpt_auth_registers_agent_identity_when_enabled() -> anyhow::Result<
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await?
     .expect("auth should reload");
@@ -461,7 +461,7 @@ async fn chatgpt_auth_registers_agent_identity_when_enabled() -> anyhow::Result<
             AgentIdentityAuthPolicy::ChatGptAuth,
             Some(&server.uri()),
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await?
@@ -494,7 +494,7 @@ async fn chatgpt_auth_retries_transient_agent_identity_registration() -> anyhow:
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await?
     .expect("auth should load");
@@ -523,7 +523,7 @@ async fn chatgpt_auth_retries_transient_agent_identity_registration() -> anyhow:
             AgentIdentityAuthPolicy::ChatGptAuth,
             Some(&server.uri()),
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await?
@@ -560,7 +560,7 @@ async fn chatgpt_auth_registration_retry_exhaustion_is_fallback_eligible() -> an
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await?
     .expect("auth should load");
@@ -578,7 +578,7 @@ async fn chatgpt_auth_registration_retry_exhaustion_is_fallback_eligible() -> an
             AgentIdentityAuthPolicy::ChatGptAuth,
             Some(&server.uri()),
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await
@@ -621,7 +621,7 @@ async fn chatgpt_auth_task_registration_retry_exhaustion_is_fallback_eligible()
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await?
     .expect("auth should load");
@@ -642,7 +642,7 @@ async fn chatgpt_auth_task_registration_retry_exhaustion_is_fallback_eligible()
             AgentIdentityAuthPolicy::ChatGptAuth,
             Some(&server.uri()),
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await
@@ -677,7 +677,7 @@ async fn chatgpt_auth_non_retryable_registration_error_is_hard_failure() -> anyh
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await?
     .expect("auth should load");
@@ -695,7 +695,7 @@ async fn chatgpt_auth_non_retryable_registration_error_is_hard_failure() -> anyh
             AgentIdentityAuthPolicy::ChatGptAuth,
             Some(&server.uri()),
             /*forced_chatgpt_workspace_id*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
             SessionSource::Cli,
         )
         .await
@@ -737,7 +737,7 @@ async fn agent_identity_jwt_task_registration_retry_exhaustion_is_strict() -> an
         &agent_identity,
         Some(&chatgpt_base_url),
         &authapi_base_url,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect_err("agent identity jwt task retry exhaustion should fail");
@@ -768,7 +768,7 @@ async fn login_with_access_token_rejects_unsigned_jwt() {
         /*forced_chatgpt_workspace_id*/ None,
         Some(&chatgpt_base_url),
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect_err("unsigned access token should fail");
@@ -790,7 +790,7 @@ async fn missing_auth_json_returns_none() {
         AuthCredentialsStoreMode::File,
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("call should succeed");
@@ -820,7 +820,7 @@ async fn pro_account_with_no_api_key_uses_chatgpt_auth() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .unwrap()
@@ -882,7 +882,7 @@ async fn loads_api_key_from_auth_json() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .unwrap()
@@ -978,7 +978,7 @@ async fn refresh_failure_is_scoped_to_the_matching_auth_snapshot() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("load auth")
@@ -999,7 +999,7 @@ async fn refresh_failure_is_scoped_to_the_matching_auth_snapshot() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("updated auth should parse");
@@ -1427,7 +1427,7 @@ async fn load_auth_reads_access_token_from_env() {
         Some(&chatgpt_base_url),
         AuthKeyringBackendKind::Direct,
         Some(&authapi_base_url),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("env auth should load")
@@ -1475,7 +1475,7 @@ async fn load_auth_reads_personal_access_token_from_env() {
             /*chatgpt_base_url*/ None,
             AuthKeyringBackendKind::default(),
             /*agent_identity_authapi_base_url*/ None,
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
         )
         .await
         .expect("env auth should load")
@@ -1569,7 +1569,7 @@ async fn auth_manager_rejects_stored_personal_access_token_workspace_mismatch()
             /*forced_chatgpt_workspace_id*/ None,
             /*chatgpt_base_url*/ None,
             AuthKeyringBackendKind::default(),
-            /*auth_route_config*/ None,
+            &crate::test_support::transport_default_auth_route_config(),
         )
         .await
         .expect("personal access token login should succeed");
@@ -1648,7 +1648,7 @@ async fn load_auth_keeps_codex_api_key_env_precedence() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("env auth should load")
@@ -1745,7 +1745,7 @@ async fn enforce_login_restrictions_logs_out_for_personal_access_token_workspace
         /*forced_chatgpt_workspace_id*/ None,
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("personal access token login should succeed");
@@ -2134,7 +2134,7 @@ async fn assert_agent_identity_plan_alias(
         &jwt,
         Some(&chatgpt_base_url),
         &authapi_base_url,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("agent identity auth");
@@ -2166,7 +2166,7 @@ async fn plan_type_maps_known_plan() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("load auth")
@@ -2198,7 +2198,7 @@ async fn plan_type_maps_self_serve_business_usage_based_plan() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("load auth")
@@ -2233,7 +2233,7 @@ async fn plan_type_maps_enterprise_cbp_usage_based_plan() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("load auth")
@@ -2268,7 +2268,7 @@ async fn plan_type_maps_unknown_to_unknown() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("load auth")
@@ -2300,7 +2300,7 @@ async fn missing_plan_type_maps_to_unknown() {
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::Direct,
         /*agent_identity_authapi_base_url*/ None,
-        /*auth_route_config*/ None,
+        &crate::test_support::transport_default_auth_route_config(),
     )
     .await
     .expect("load auth")

codex-rs/login/src/auth/default_client.rs

@@ -299,31 +299,25 @@ fn build_default_client(builder: HttpClientBuilder) -> HttpClient {
 /// Builds an HTTP client for an auth endpoint without Codex default headers.
 pub(crate) fn create_raw_auth_client(
     endpoint: &str,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> Result<HttpClient, BuildRouteAwareHttpClientError> {
-    auth_http_client_factory(auth_route_config)
+    auth_route_config
+        .http_client_factory()
         .build_client_without_request_logging(endpoint, ClientRouteClass::Auth)
 }
 
 /// Builds the default Codex HTTP client wrapper for an auth endpoint.
 pub(crate) fn create_default_auth_client(
     endpoint: &str,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> Result<HttpClient, BuildRouteAwareHttpClientError> {
     create_client_for_route(
-        &auth_http_client_factory(auth_route_config),
+        auth_route_config.http_client_factory(),
         endpoint,
         ClientRouteClass::Auth,
     )
 }
 
-fn auth_http_client_factory(auth_route_config: Option<&AuthRouteConfig>) -> HttpClientFactory {
-    auth_route_config.map_or_else(
-        || HttpClientFactory::new(OutboundProxyPolicy::ReqwestDefault),
-        |config| config.http_client_factory().clone(),
-    )
-}
-
 pub fn default_headers() -> HeaderMap {
     let mut headers = HeaderMap::new();
     headers.insert("originator", originator().header_value);

codex-rs/login/src/auth/default_client_tests.rs

@@ -198,8 +198,11 @@ async fn raw_auth_client_does_not_log_sensitive_request_or_response_data() {
     let endpoint = format!(
         "http://auth-user:password-secret-value@{authority}/token?client_secret=query-secret-value"
     );
-    let client = create_raw_auth_client(&endpoint, /*auth_route_config*/ None)
-        .expect("raw auth client should build");
+    let client = create_raw_auth_client(
+        &endpoint,
+        &crate::test_support::transport_default_auth_route_config(),
+    )
+    .expect("raw auth client should build");
     let buffer = Arc::new(Mutex::new(Vec::new()));
     let subscriber = tracing_subscriber::registry().with(
         tracing_subscriber::fmt::layer()
@@ -228,9 +231,11 @@ async fn raw_auth_client_does_not_log_sensitive_request_or_response_data() {
     let unresponsive_endpoint = format!(
         "http://auth-user:failure-password-secret-value@{unresponsive_addr}/token?client_secret=failure-query-secret-value"
     );
-    let unresponsive_client =
-        create_raw_auth_client(&unresponsive_endpoint, /*auth_route_config*/ None)
-            .expect("raw auth client should build");
+    let unresponsive_client = create_raw_auth_client(
+        &unresponsive_endpoint,
+        &crate::test_support::transport_default_auth_route_config(),
+    )
+    .expect("raw auth client should build");
     let error = unresponsive_client
         .post(&unresponsive_endpoint)
         .header("x-sensitive-request", "failure-request-header-secret-value")

codex-rs/login/src/auth/manager.rs

@@ -253,7 +253,7 @@ impl CodexAuth {
         chatgpt_base_url: Option<&str>,
         keyring_backend_kind: AuthKeyringBackendKind,
         agent_identity_authapi_base_url: Option<&str>,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Self> {
         let auth_mode = auth_dot_json.resolved_mode();
         if auth_mode == AuthMode::ApiKey {
@@ -353,7 +353,7 @@ impl CodexAuth {
         auth_credentials_store_mode: AuthCredentialsStoreMode,
         chatgpt_base_url: Option<&str>,
         keyring_backend_kind: AuthKeyringBackendKind,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Option<Self>> {
         let agent_identity_authapi_base_url =
             agent_identity_authapi_base_url(chatgpt_base_url).ok();
@@ -373,7 +373,7 @@ impl CodexAuth {
     pub async fn from_agent_identity_jwt(
         jwt: &str,
         chatgpt_base_url: Option<&str>,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Self> {
         let agent_identity_authapi_base_url = agent_identity_authapi_base_url(chatgpt_base_url)?;
         Self::from_agent_identity_jwt_with_authapi_base_url(
@@ -389,7 +389,7 @@ impl CodexAuth {
         jwt: &str,
         chatgpt_base_url: Option<&str>,
         agent_identity_authapi_base_url: &str,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Self> {
         let base_url = chatgpt_base_url
             .unwrap_or(ChatGptEnvironment::default().chatgpt_base_url())
@@ -408,7 +408,7 @@ impl CodexAuth {
 
     pub async fn from_personal_access_token(
         access_token: &str,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Self> {
         Ok(Self::PersonalAccessToken(
             PersonalAccessTokenAuth::load(access_token, auth_route_config).await?,
@@ -632,7 +632,7 @@ impl CodexAuth {
         policy: AgentIdentityAuthPolicy,
         agent_identity_authapi_base_url: Option<&str>,
         forced_chatgpt_workspace_id: Option<Vec<String>>,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
         session_source: SessionSource,
     ) -> std::io::Result<Option<AgentIdentityAuth>> {
         match self {
@@ -662,7 +662,7 @@ impl CodexAuth {
         &self,
         agent_identity_authapi_base_url: &str,
         forced_chatgpt_workspace_id: Option<Vec<String>>,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
         session_source: SessionSource,
     ) -> std::io::Result<AgentIdentityAuth> {
         let binding =
@@ -880,7 +880,7 @@ pub async fn logout_with_revoke(
     codex_home: &Path,
     auth_credentials_store_mode: AuthCredentialsStoreMode,
     keyring_backend_kind: AuthKeyringBackendKind,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> std::io::Result<bool> {
     let auth_dot_json = match load_auth_dot_json(
         codex_home,
@@ -935,7 +935,7 @@ pub async fn login_with_access_token(
     forced_chatgpt_workspace_id: Option<&[String]>,
     chatgpt_base_url: Option<&str>,
     keyring_backend_kind: AuthKeyringBackendKind,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> std::io::Result<()> {
     let auth_dot_json = match classify_codex_access_token(access_token) {
         CodexAccessToken::PersonalAccessToken(access_token) => {
@@ -1073,7 +1073,7 @@ async fn enforce_login_restrictions_with_agent_identity_authapi_base_url(
         config.chatgpt_base_url.as_deref(),
         config.keyring_backend_kind,
         agent_identity_authapi_base_url,
-        Some(&config.auth_route_config),
+        &config.auth_route_config,
     )
     .await?
     else {
@@ -1222,7 +1222,7 @@ async fn load_auth(
     chatgpt_base_url: Option<&str>,
     keyring_backend_kind: AuthKeyringBackendKind,
     agent_identity_authapi_base_url: Option<&str>,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> std::io::Result<Option<CodexAuth>> {
     // API key via env var takes precedence over any other auth method.
     if enable_codex_api_key_env && let Some(api_key) = read_codex_api_key_from_env() {
@@ -1859,7 +1859,7 @@ impl AuthManager {
             chatgpt_base_url.as_deref(),
             keyring_backend_kind,
             agent_identity_authapi_base_url.as_deref(),
-            Some(&auth_route_config),
+            &auth_route_config,
         )
         .await
         .ok()
@@ -2080,7 +2080,7 @@ impl AuthManager {
                     policy,
                     self.agent_identity_authapi_base_url.as_deref(),
                     forced_chatgpt_workspace_id,
-                    Some(&self.auth_route_config),
+                    &self.auth_route_config,
                     session_source,
                 )
                 .await;
@@ -2099,7 +2099,7 @@ impl AuthManager {
             policy,
             self.agent_identity_authapi_base_url.as_deref(),
             self.forced_chatgpt_workspace_id(),
-            Some(&self.auth_route_config),
+            &self.auth_route_config,
             session_source,
         )
         .await
@@ -2218,7 +2218,7 @@ impl AuthManager {
             self.chatgpt_base_url.as_deref(),
             self.keyring_backend_kind,
             self.agent_identity_authapi_base_url.as_deref(),
-            Some(&self.auth_route_config),
+            &self.auth_route_config,
         )
         .await
         .ok()
@@ -2478,8 +2478,7 @@ impl AuthManager {
         let auth_dot_json = self
             .auth_cached()
             .and_then(|auth| auth.get_current_auth_json());
-        if let Err(err) =
-            revoke_auth_tokens(auth_dot_json.as_ref(), Some(&self.auth_route_config)).await
+        if let Err(err) = revoke_auth_tokens(auth_dot_json.as_ref(), &self.auth_route_config).await
         {
             tracing::warn!("failed to revoke auth tokens during logout: {err}");
         }

codex-rs/login/src/auth/personal_access_token.rs

@@ -39,7 +39,7 @@ impl fmt::Debug for PersonalAccessTokenAuth {
 impl PersonalAccessTokenAuth {
     pub(super) async fn load(
         access_token: &str,
-        auth_route_config: Option<&AuthRouteConfig>,
+        auth_route_config: &AuthRouteConfig,
     ) -> std::io::Result<Self> {
         let authapi_base_url = env::var(CODEX_AUTHAPI_BASE_URL_ENV_VAR)
             .ok()

codex-rs/login/src/auth/revoke.rs

@@ -54,7 +54,7 @@ struct RevokeTokenRequest<'a> {
 
 pub(super) async fn revoke_auth_tokens(
     auth_dot_json: Option<&AuthDotJson>,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> Result<(), std::io::Error> {
     let Some((token, kind)) = auth_dot_json.and_then(revocable_token) else {
         return Ok(());

codex-rs/login/src/device_code_auth.rs

@@ -166,7 +166,7 @@ pub async fn request_device_code(opts: &ServerOptions) -> std::io::Result<Device
     let base_url = opts.issuer.trim_end_matches('/');
     // The route selected for the issuer is reused for all device-auth endpoint paths; the endpoint
     // paths are not resolved separately.
-    let client = create_raw_auth_client(base_url, opts.auth_route_config.as_ref())?;
+    let client = create_raw_auth_client(base_url, &opts.auth_route_config)?;
     let api_base_url = format!("{base_url}/api/accounts");
     let uc = request_user_code(&client, &api_base_url, &opts.client_id).await?;
 
@@ -183,7 +183,7 @@ pub async fn complete_device_code_login(
     device_code: DeviceCode,
 ) -> std::io::Result<()> {
     let base_url = opts.issuer.trim_end_matches('/');
-    let client = create_raw_auth_client(base_url, opts.auth_route_config.as_ref())?;
+    let client = create_raw_auth_client(base_url, &opts.auth_route_config)?;
     let api_base_url = format!("{base_url}/api/accounts");
 
     let code_resp = poll_for_token(
@@ -207,7 +207,7 @@ pub async fn complete_device_code_login(
         &redirect_uri,
         &pkce,
         &code_resp.authorization_code,
-        opts.auth_route_config.as_ref(),
+        &opts.auth_route_config,
     )
     .await
     .map_err(|err| std::io::Error::other(format!("device code exchange failed: {err}")))?;

codex-rs/login/src/server.rs

@@ -77,7 +77,7 @@ pub struct ServerOptions {
     pub login_success_page: LoginSuccessPage,
     pub cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
     pub auth_keyring_backend_kind: AuthKeyringBackendKind,
-    pub auth_route_config: Option<AuthRouteConfig>,
+    pub auth_route_config: AuthRouteConfig,
 }
 
 impl ServerOptions {
@@ -88,7 +88,7 @@ impl ServerOptions {
         forced_chatgpt_workspace_id: Option<Vec<String>>,
         cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
         auth_keyring_backend_kind: AuthKeyringBackendKind,
-        auth_route_config: Option<AuthRouteConfig>,
+        auth_route_config: AuthRouteConfig,
     ) -> Self {
         Self {
             codex_home,
@@ -387,7 +387,7 @@ async fn process_request(
                 redirect_uri,
                 pkce,
                 &code,
-                opts.auth_route_config.as_ref(),
+                &opts.auth_route_config,
             )
             .await
             {
@@ -409,7 +409,7 @@ async fn process_request(
                         &opts.issuer,
                         &opts.client_id,
                         &tokens.id_token,
-                        opts.auth_route_config.as_ref(),
+                        &opts.auth_route_config,
                     )
                     .await
                     .ok();
@@ -789,7 +789,7 @@ pub(crate) async fn exchange_code_for_tokens(
     redirect_uri: &str,
     pkce: &PkceCodes,
     code: &str,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> io::Result<ExchangedTokens> {
     #[derive(serde::Deserialize)]
     struct TokenResponse {
@@ -1114,7 +1114,7 @@ pub(crate) async fn obtain_api_key(
     issuer: &str,
     client_id: &str,
     id_token: &str,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) -> io::Result<String> {
     // Token exchange for an API key access token
     #[derive(serde::Deserialize)]