Relax API key length and character validation for custom `responses-api-endpoint`

Read the Rust implementation under codex-rs/responses-api-proxy, starting with the API-key buffer allocation and character-validation logic described in the issue. Verify how custom responses-api-endpoint authentication is handled, then confirm that long JWT or Base64-style tokens are accepted without weakening validation for other endpoints.

What issue are you seeing?

When using a custom responses-api-endpoint to integrate with an OpenAI-compatible API gateway (such as Amazon Bedrock Mantle or other custom enterprise endpoints), the internal responses-api-proxy fails to accept the authentication token.

Depending on the token structure provided, it throws the following errors:

1. Length Limit Constraint:

Error: API key is too large to fit in the 1024-byte buffer
responses-api-proxy did not write server info

JWTs and temporary access tokens frequently exceed the fixed 1024-byte buffer allocation.

2. Character Validation Constraint:

Error: API key may only contain ASCII letters, numbers, '-' or '_'
responses-api-proxy did not write server info

Standard authentication tokens or base64-encoded strings naturally contain characters like ., +, /, and =, which are strictly rejected by the current regex or character checks.

What steps can reproduce the bug?

Configure a GitHub Actions workflow using openai/codex-action@v1 with a custom responses-api-endpoint and pass a standard JWT or long access token containing dots or special characters:

- name: Run Codex
  uses: openai/codex-action@v1
  with:
    # Set a custom OpenAI-compatible endpoint
    responses-api-endpoint: "[https://your-custom-gateway.api.aws/v1/responses](https://your-custom-gateway.api.aws/v1/responses)"
    
    # Pass a standard JWT or an access token containing '.', '+', or '='
    openai-api-key: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c..."
    
    model: "openai.gpt-5.5"
    permission-profile: ":workspace"
    prompt: |
      Review the changes introduced by the PR.

What is the expected behavior?

When a custom responses-api-endpoint is explicitly specified, the proxy should be flexible enough to handle alternative enterprise authentication tokens.

Specifically:

• The stack/heap buffer size allocated for the API key should be expanded (e.g., up to 4096 or 8192 bytes) to accommodate typical JWT lengths.
• The character validation logic should be relaxed to accept standard Base64/JWT characters (., +, /, =), or skipped entirely if the target endpoint is not the official OpenAI/Azure API.

Additional information

The root cause seems to reside in the Rust-based proxy component (codex-rs/responses-api-proxy), which enforces rigid, secure constraints optimized purely for official OpenAI (sk-...) or Azure API key layouts.

While the action natively offers a powerful extensibility feature via responses-api-endpoint, these strict token validation boundaries effectively block legitimate integrations with external compatible infrastructures like AWS Bedrock Mantle.