openai-codex-auth 0.1.0__tar.gz

openai_codex_auth-0.1.0/PKG-INFO

@@ -0,0 +1,73 @@
+Metadata-Version: 2.4
+Name: openai-codex-auth
+Version: 0.1.0
+Summary: Use the Codex CLI's ChatGPT login (~/.codex/auth.json) as a bearer credential for the Codex backend
+Keywords: codex,chatgpt,oauth,openai
+Author: hrbatra
+Author-email: hrbatra <hrbatra@utexas.edu>
+License-Expression: MIT
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Dist: requests>=2.32.0
+Requires-Python: >=3.12
+Project-URL: Homepage, https://github.com/hrbatra/openai-codex-auth
+Project-URL: Issues, https://github.com/hrbatra/openai-codex-auth/issues
+Project-URL: Repository, https://github.com/hrbatra/openai-codex-auth
+Description-Content-Type: text/markdown
+
+# openai-codex-auth
+
+Use the Codex CLI's ChatGPT login as a bearer credential, so OpenAI model calls
+bill to a ChatGPT (Codex) subscription instead of an API key.
+
+`codex login` stores tokens in `~/.codex/auth.json`. This package reads them,
+refreshes the access token when it has expired, and writes the result back in
+the CLI's format so the two stay in sync. One runtime dependency: `requests`.
+
+## Install
+
+```bash
+uv add openai-codex-auth
+codex login   # once, choosing "Sign in with ChatGPT"
+```
+
+## Usage
+
+```python
+import openai_codex_auth
+
+auth = openai_codex_auth.CodexAuth()          # or CodexAuth("/path/to/auth.json")
+token = auth.token()                            # refreshed if expired
+headers = openai_codex_auth.codex_headers(token, account_id=auth.account_id(), originator="my_app")
+base_url = openai_codex_auth.DEFAULT_CODEX_API_BASE
+```
+
+Send Responses API requests to `base_url` with `Authorization: Bearer <token>`
+plus `headers`. The backend requires `stream: true`, rejects `system` role
+input items (use `instructions` or `developer`), and rejects
+`max_output_tokens`.
+
+`openai_codex_auth.getauthtoken()` is the one-call form of the above.
+
+Refreshes take an exclusive lock on the file, so parallel processes sharing
+one login do not race each other. A missing file, or a CLI signed in with an
+API key rather than ChatGPT, raises `CodexAuthError` naming `codex login`.
+
+## Development
+
+```bash
+uv sync --dev
+uv run pytest
+uv run ruff check .
+uv build --no-sources
+```
+
+## Release
+
+See [RELEASING.md](RELEASING.md).

openai_codex_auth-0.1.0/README.md

@@ -0,0 +1,50 @@
+# openai-codex-auth
+
+Use the Codex CLI's ChatGPT login as a bearer credential, so OpenAI model calls
+bill to a ChatGPT (Codex) subscription instead of an API key.
+
+`codex login` stores tokens in `~/.codex/auth.json`. This package reads them,
+refreshes the access token when it has expired, and writes the result back in
+the CLI's format so the two stay in sync. One runtime dependency: `requests`.
+
+## Install
+
+```bash
+uv add openai-codex-auth
+codex login   # once, choosing "Sign in with ChatGPT"
+```
+
+## Usage
+
+```python
+import openai_codex_auth
+
+auth = openai_codex_auth.CodexAuth()          # or CodexAuth("/path/to/auth.json")
+token = auth.token()                            # refreshed if expired
+headers = openai_codex_auth.codex_headers(token, account_id=auth.account_id(), originator="my_app")
+base_url = openai_codex_auth.DEFAULT_CODEX_API_BASE
+```
+
+Send Responses API requests to `base_url` with `Authorization: Bearer <token>`
+plus `headers`. The backend requires `stream: true`, rejects `system` role
+input items (use `instructions` or `developer`), and rejects
+`max_output_tokens`.
+
+`openai_codex_auth.getauthtoken()` is the one-call form of the above.
+
+Refreshes take an exclusive lock on the file, so parallel processes sharing
+one login do not race each other. A missing file, or a CLI signed in with an
+API key rather than ChatGPT, raises `CodexAuthError` naming `codex login`.
+
+## Development
+
+```bash
+uv sync --dev
+uv run pytest
+uv run ruff check .
+uv build --no-sources
+```
+
+## Release
+
+See [RELEASING.md](RELEASING.md).

openai_codex_auth-0.1.0/pyproject.toml

@@ -0,0 +1,47 @@
+[project]
+name = "openai-codex-auth"
+version = "0.1.0"
+description = "Use the Codex CLI's ChatGPT login (~/.codex/auth.json) as a bearer credential for the Codex backend"
+readme = "README.md"
+authors = [
+    { name = "hrbatra", email = "hrbatra@utexas.edu" }
+]
+license = "MIT"
+requires-python = ">=3.12"
+keywords = ["codex", "chatgpt", "oauth", "openai"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+    "requests>=2.32.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/hrbatra/openai-codex-auth"
+Repository = "https://github.com/hrbatra/openai-codex-auth"
+Issues = "https://github.com/hrbatra/openai-codex-auth/issues"
+
+[build-system]
+requires = ["uv_build>=0.9.17,<0.10.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=8.0",
+    "ruff>=0.15",
+]
+
+[tool.ruff]
+target-version = "py312"
+
+[tool.ruff.lint]
+# Pin the rule set: ruff 0.16 widened its defaults, and the auth module is kept
+# byte-for-byte close to its dspy-codex-auth origin rather than restyled.
+select = ["E4", "E7", "E9", "F", "I"]

openai_codex_auth-0.1.0/src/openai_codex_auth/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 hrbatra
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

openai_codex_auth-0.1.0/src/openai_codex_auth/__init__.py

@@ -0,0 +1,140 @@
+"""Use the Codex CLI's ChatGPT login as a bearer credential.
+
+Run ``codex login`` once. This module reads the tokens the CLI stores in
+``~/.codex/auth.json``, refreshes the access token when it has expired, and
+writes the result back in the CLI's own format so both stay in sync.
+"""
+
+from __future__ import annotations
+
+import base64
+import fcntl
+import json
+import os
+import time
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+import requests
+
+DEFAULT_AUTH_PATH = Path("~/.codex/auth.json").expanduser()
+DEFAULT_CODEX_API_BASE = "https://chatgpt.com/backend-api/codex"
+DEFAULT_CODEX_ORIGINATOR = "openai_codex_auth"
+CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token"
+_ACCOUNT_CLAIM = "https://api.openai.com/auth"
+_EXPIRY_LEEWAY_SECONDS = 60
+
+
+class CodexAuthError(RuntimeError):
+    """No usable ChatGPT credential in the Codex CLI auth file."""
+
+
+def _jwt_claims(token: str) -> dict[str, Any]:
+    payload = token.split(".")[1]
+    payload += "=" * (-len(payload) % 4)
+    return json.loads(base64.urlsafe_b64decode(payload))
+
+
+def _is_fresh(access_token: str) -> bool:
+    return _jwt_claims(access_token).get("exp", 0) > time.time() + _EXPIRY_LEEWAY_SECONDS
+
+
+class CodexAuth:
+    """Access token and account id from the Codex CLI's ``auth.json``."""
+
+    def __init__(self, path: str | os.PathLike[str] = DEFAULT_AUTH_PATH):
+        self.path = Path(path).expanduser()
+
+    def _read(self) -> dict[str, Any]:
+        try:
+            data = json.loads(self.path.read_text())
+        except FileNotFoundError:
+            raise CodexAuthError(
+                f"No Codex credential at {self.path}. Run `codex login`."
+            ) from None
+        tokens = data.get("tokens") or {}
+        if not tokens.get("access_token") or not tokens.get("refresh_token"):
+            raise CodexAuthError(
+                f"{self.path} has no ChatGPT login (auth_mode="
+                f"{data.get('auth_mode')!r}). Run `codex login` and sign in with ChatGPT."
+            )
+        return data
+
+    def token(self) -> str:
+        """The current access token, refreshed first if it has expired."""
+        access = self._read()["tokens"]["access_token"]
+        if _is_fresh(access):
+            return access
+        return self._refresh()["tokens"]["access_token"]
+
+    def account_id(self) -> str:
+        tokens = self._read()["tokens"]
+        return tokens.get("account_id") or _jwt_claims(tokens["access_token"])[
+            _ACCOUNT_CLAIM
+        ]["chatgpt_account_id"]
+
+    def _refresh(self) -> dict[str, Any]:
+        with self.path.open("r+") as handle:
+            fcntl.flock(handle, fcntl.LOCK_EX)
+            data = json.loads(handle.read())
+            tokens = data["tokens"]
+            if _is_fresh(tokens["access_token"]):
+                return data  # another process refreshed while we waited for the lock
+            response = requests.post(
+                CODEX_TOKEN_URL,
+                data={
+                    "grant_type": "refresh_token",
+                    "refresh_token": tokens["refresh_token"],
+                    "client_id": CODEX_CLIENT_ID,
+                },
+                timeout=30,
+            )
+            response.raise_for_status()
+            fresh = response.json()
+            tokens["access_token"] = fresh["access_token"]
+            tokens["refresh_token"] = fresh.get("refresh_token") or tokens["refresh_token"]
+            if fresh.get("id_token"):
+                tokens["id_token"] = fresh["id_token"]
+            data["last_refresh"] = datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+            handle.seek(0)
+            handle.truncate()
+            json.dump(data, handle, indent=2)
+            return data
+
+
+def getauthtoken(path: str | os.PathLike[str] = DEFAULT_AUTH_PATH) -> str:
+    return CodexAuth(path).token()
+
+
+def codex_headers(
+    token: str,
+    *,
+    account_id: str | None = None,
+    originator: str = DEFAULT_CODEX_ORIGINATOR,
+    extra_headers: dict[str, Any] | None = None,
+) -> dict[str, str]:
+    """Headers the Codex backend expects alongside ``Authorization: Bearer``."""
+    headers = {
+        "chatgpt-account-id": account_id
+        or _jwt_claims(token)[_ACCOUNT_CLAIM]["chatgpt_account_id"],
+        "OpenAI-Beta": "responses=experimental",
+        "originator": originator,
+    }
+    if extra_headers:
+        headers.update({str(key): str(value) for key, value in extra_headers.items()})
+    return headers
+
+
+__all__ = [
+    "CODEX_CLIENT_ID",
+    "CODEX_TOKEN_URL",
+    "DEFAULT_AUTH_PATH",
+    "DEFAULT_CODEX_API_BASE",
+    "DEFAULT_CODEX_ORIGINATOR",
+    "CodexAuth",
+    "CodexAuthError",
+    "codex_headers",
+    "getauthtoken",
+]