openai / openai/codex

auth command called too frequently (upon conversation switch)

Open
#38,068 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

app auth azure bug custom-model
Dominant language
Rust
Stars
125k
Forks
19.5k
PR merge metrics
PR metrics pending

Description

What version of the Codex App are you using (From “About Codex” dialog)?

26.727.51351

What subscription do you have?

Azure

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

We have an internal OpenAI endpoint that is based on Azure Foundry, and we have a service that issues token dynamically. For Codex app/ChatGPT, we are using "auth command" as in mentioned in Custom Model Providers, and more specifically this

[model_providers.proxy.auth]
command = "/usr/local/bin/fetch-codex-token"
args = ["--audience", "codex"]
timeout_ms = 5000
refresh_interval_ms = 300000

Despite setting up a refresh_interval_ms, we noticed that this command is called too frequently -- it is called whenever user switches to a different conversation. This could result in excessive amount of requests for new tokens

What steps can reproduce the bug?
  • set up the "command" as in the doc and above and point to a command that prints token while does logging
  • launch ChatGPT/Codex app, and switch between conversations
  • observe logs
What is the expected behavior?

the command is only run when

  • a token is first obtained
  • existing token expires after TTL
  • application sees a 401 error
Additional information

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the custom model provider auth configuration, focusing on refresh_interval_ms and the auth command lifecycle. Reproduce the issue by logging the token command while switching conversations, then verify that it runs only for initial token acquisition, expiry, or a 401 response.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.