mirror of https://github.com/openai/codex.git synced 2026-10-20 08:19:50 +00:00

Files

T

History

ee 57560e9d53 Enable GitHub Actions OIDC authentication in the Responses API proxy (#55320 )

## Why

GitHub Actions workflows can use short-lived OpenAI credentials instead of storing a long-lived OpenAI API key in GitHub secrets.

## What changed

- Add `--github-oidc` with required audience, identity provider, service account, and GitHub token-request URL settings. Read the GitHub request credential from stdin and connect it to the existing federated authentication flow.
- Require the default OpenAI Responses endpoint in OIDC mode before reading credentials, and complete the initial token exchange before publishing server info.
- Close the npm launcher's copy of stdin after the native child starts.
- Document OIDC setup, credential handling, renewal behavior, and caller responsibilities. Keep API-key authentication as the default.

## Testing

Add tests for required OIDC flags, upstream restrictions before credential reads, rejection of unsafe or empty settings without exposing sensitive input, and failure when a configured custom CA cannot be loaded in the CLI blocking context.

GitOrigin-RevId: 7de6fd4c3491e7ccd6a2c2ccdee0bc2eedd0e642

2026-10-19 16:56:42 +00:00

bin

Enable GitHub Actions OIDC authentication in the Responses API proxy (#55320 )

2026-10-19 16:56:42 +00:00

package.json

Upgrade pnpm to 10.34.5 (#39967 )

2026-08-21 16:45:05 +00:00

README.md

feat: introduce npm module for codex-responses-api-proxy (#4417 )

2025-09-28 19:34:06 -07:00

README.md

@openai/codex-responses-api-proxy

npm i -g @openai/codex-responses-api-proxy to install codex-responses-api-proxy

This package distributes the prebuilt Codex Responses API proxy binary for macOS, Linux, and Windows.

To see available options, run:

node ./bin/codex-responses-api-proxy.js --help

Refer to codex-rs/responses-api-proxy/README.md for detailed documentation.