Move auth code into login crate

- Move the auth implementation and token data into `codex-login` instead of a standalone auth crate.
- Keep `codex-core` re-exporting that surface from `codex-login` for existing callers.

Co-authored-by: Codex <noreply@openai.com>

codex-rs/Cargo.lock

@@ -1598,34 +1598,6 @@ dependencies = [
  "tokio-util",
 ]
 
-[[package]]
-name = "codex-auth"
-version = "0.0.0"
-dependencies = [
- "anyhow",
- "async-trait",
- "base64 0.22.1",
- "chrono",
- "codex-app-server-protocol",
- "codex-client",
- "codex-keyring-store",
- "codex-otel",
- "codex-protocol",
- "keyring",
- "once_cell",
- "pretty_assertions",
- "reqwest",
- "schemars 0.8.22",
- "serde",
- "serde_json",
- "serial_test",
- "sha2",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "codex-backend-client"
 version = "0.0.0"
@@ -1877,7 +1849,6 @@ dependencies = [
  "codex-arg0",
  "codex-artifacts",
  "codex-async-utils",
- "codex-auth",
  "codex-client",
  "codex-config",
  "codex-connectors",
@@ -1887,6 +1858,7 @@ dependencies = [
  "codex-git",
  "codex-hooks",
  "codex-keyring-store",
+ "codex-login",
  "codex-network-proxy",
  "codex-otel",
  "codex-protocol",
@@ -2209,19 +2181,27 @@ name = "codex-login"
 version = "0.0.0"
 dependencies = [
  "anyhow",
+ "async-trait",
  "base64 0.22.1",
  "chrono",
  "codex-app-server-protocol",
  "codex-client",
- "codex-core",
+ "codex-keyring-store",
+ "codex-otel",
+ "codex-protocol",
  "core_test_support",
+ "keyring",
+ "once_cell",
  "pretty_assertions",
  "rand 0.9.2",
  "reqwest",
+ "schemars 0.8.22",
  "serde",
  "serde_json",
+ "serial_test",
  "sha2",
  "tempfile",
+ "thiserror 2.0.18",
  "tiny_http",
  "tokio",
  "tracing",

codex-rs/Cargo.toml

@@ -10,7 +10,6 @@ members = [
     "debug-client",
     "apply-patch",
     "arg0",
-    "auth",
     "feedback",
     "codex-backend-openapi-models",
     "cloud-requirements",
@@ -98,7 +97,6 @@ codex-app-server-test-client = { path = "app-server-test-client" }
 codex-apply-patch = { path = "apply-patch" }
 codex-arg0 = { path = "arg0" }
 codex-async-utils = { path = "async-utils" }
-codex-auth = { path = "auth" }
 codex-backend-client = { path = "backend-client" }
 codex-chatgpt = { path = "chatgpt" }
 codex-cli = { path = "cli" }

codex-rs/auth/BUILD.bazel

@@ -1,7 +0,0 @@
-load("//:defs.bzl", "codex_rust_crate")
-
-codex_rust_crate(
-    name = "auth",
-    crate_name = "codex_auth",
-    crate_srcs = glob(["*.rs"]),
-)

codex-rs/auth/Cargo.toml

@@ -1,39 +0,0 @@
-[package]
-edition.workspace = true
-license.workspace = true
-name = "codex-auth"
-version.workspace = true
-
-[lib]
-doctest = false
-name = "codex_auth"
-path = "lib.rs"
-
-[lints]
-workspace = true
-
-[dependencies]
-async-trait = { workspace = true }
-base64 = { workspace = true }
-chrono = { workspace = true, features = ["serde"] }
-codex-app-server-protocol = { workspace = true }
-codex-client = { workspace = true }
-codex-keyring-store = { workspace = true }
-codex-otel = { workspace = true }
-codex-protocol = { workspace = true }
-once_cell = { workspace = true }
-reqwest = { workspace = true }
-schemars = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-sha2 = { workspace = true }
-thiserror = { workspace = true }
-tracing = { workspace = true }
-
-[dev-dependencies]
-anyhow = { workspace = true }
-keyring = { workspace = true }
-pretty_assertions = { workspace = true }
-serial_test = { workspace = true }
-tempfile = { workspace = true }
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

codex-rs/core/Cargo.toml

@@ -31,11 +31,11 @@ codex-api = { workspace = true }
 codex-app-server-protocol = { workspace = true }
 codex-apply-patch = { workspace = true }
 codex-async-utils = { workspace = true }
-codex-auth = { workspace = true }
 codex-client = { workspace = true }
 codex-connectors = { workspace = true }
 codex-config = { workspace = true }
 codex-exec-server = { workspace = true }
+codex-login = { workspace = true }
 codex-shell-command = { workspace = true }
 codex-skills = { workspace = true }
 codex-execpolicy = { workspace = true }

codex-rs/core/src/error.rs

@@ -9,8 +9,8 @@ use chrono::Datelike;
 use chrono::Local;
 use chrono::Utc;
 use codex_async_utils::CancelErr;
-pub use codex_auth::RefreshTokenFailedError;
-pub use codex_auth::RefreshTokenFailedReason;
+pub use codex_login::auth::RefreshTokenFailedError;
+pub use codex_login::auth::RefreshTokenFailedReason;
 use codex_protocol::ThreadId;
 use codex_protocol::protocol::CodexErrorInfo;
 use codex_protocol::protocol::ErrorEvent;

codex-rs/core/src/lib.rs

@@ -10,7 +10,7 @@ pub mod api_bridge;
 mod apply_patch;
 mod apps;
 mod arc_monitor;
-pub use codex_auth as auth;
+pub use codex_login as auth;
 mod auth_env_telemetry;
 mod client;
 mod client_common;
@@ -76,7 +76,7 @@ mod shell_detect;
 mod stream_events_utils;
 pub mod test_support;
 mod text_encoding;
-pub use codex_auth::token_data;
+pub use codex_login::token_data;
 mod truncate;
 mod unified_exec;
 pub mod windows_sandbox;

codex-rs/login/Cargo.toml

@@ -8,16 +8,22 @@ license.workspace = true
 workspace = true
 
 [dependencies]
+async-trait = { workspace = true }
 base64 = { workspace = true }
 chrono = { workspace = true, features = ["serde"] }
-codex-client = { workspace = true }
-codex-core = { workspace = true }
 codex-app-server-protocol = { workspace = true }
+codex-client = { workspace = true }
+codex-keyring-store = { workspace = true }
+codex-otel = { workspace = true }
+codex-protocol = { workspace = true }
+once_cell = { workspace = true }
 rand = { workspace = true }
 reqwest = { workspace = true, features = ["json", "blocking"] }
+schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 sha2 = { workspace = true }
+thiserror = { workspace = true }
 tiny_http = { workspace = true }
 tokio = { workspace = true, features = [
     "io-std",
@@ -34,6 +40,8 @@ webbrowser = { workspace = true }
 [dev-dependencies]
 anyhow = { workspace = true }
 core_test_support = { workspace = true }
+keyring = { workspace = true }
 pretty_assertions = { workspace = true }
+serial_test = { workspace = true }
 tempfile = { workspace = true }
 wiremock = { workspace = true }

codex-rs/login/src/auth/auth.rs

@@ -17,17 +17,17 @@ use codex_app_server_protocol::AuthMode as ApiAuthMode;
 use codex_otel::TelemetryAuthMode;
 use codex_protocol::config_types::ForcedLoginMethod;
 
-use crate::error::RefreshTokenFailedError;
-use crate::error::RefreshTokenFailedReason;
-pub use crate::storage::AuthCredentialsStoreMode;
-pub use crate::storage::AuthDotJson;
-use crate::storage::AuthStorageBackend;
-use crate::storage::create_auth_storage;
+use crate::auth::error::RefreshTokenFailedError;
+use crate::auth::error::RefreshTokenFailedReason;
+pub use crate::auth::storage::AuthCredentialsStoreMode;
+pub use crate::auth::storage::AuthDotJson;
+use crate::auth::storage::AuthStorageBackend;
+use crate::auth::storage::create_auth_storage;
+use crate::auth::util::try_parse_error_message;
 use crate::token_data::KnownPlan as InternalKnownPlan;
 use crate::token_data::PlanType as InternalPlanType;
 use crate::token_data::TokenData;
 use crate::token_data::parse_chatgpt_jwt_claims;
-use crate::util::try_parse_error_message;
 use codex_client::CodexHttpClient;
 use codex_protocol::account::PlanType as AccountPlanType;
 use serde_json::Value;

codex-rs/login/src/auth/auth_tests.rs

@@ -1,6 +1,6 @@
 use super::*;
-use crate::storage::FileAuthStorage;
-use crate::storage::get_auth_file;
+use crate::auth::storage::FileAuthStorage;
+use crate::auth::storage::get_auth_file;
 use crate::token_data::IdTokenInfo;
 use crate::token_data::KnownPlan as InternalKnownPlan;
 use crate::token_data::PlanType as InternalPlanType;

codex-rs/login/src/auth/mod.rs

@@ -1,6 +1,5 @@
 pub mod error;
 mod storage;
-pub mod token_data;
 mod util;
 
 mod auth;

codex-rs/login/src/lib.rs

@@ -1,3 +1,6 @@
+pub mod auth;
+pub mod token_data;
+
 mod device_code_auth;
 mod pkce;
 mod server;
@@ -12,15 +15,14 @@ pub use server::ServerOptions;
 pub use server::ShutdownHandle;
 pub use server::run_login_server;
 
-// Re-export commonly used auth types and helpers from codex-core for compatibility
+pub use auth::AuthDotJson;
+pub use auth::AuthManager;
+pub use auth::CLIENT_ID;
+pub use auth::CODEX_API_KEY_ENV_VAR;
+pub use auth::CodexAuth;
+pub use auth::OPENAI_API_KEY_ENV_VAR;
+pub use auth::login_with_api_key;
+pub use auth::logout;
+pub use auth::save_auth;
 pub use codex_app_server_protocol::AuthMode;
-pub use codex_core::AuthManager;
-pub use codex_core::CodexAuth;
-pub use codex_core::auth::AuthDotJson;
-pub use codex_core::auth::CLIENT_ID;
-pub use codex_core::auth::CODEX_API_KEY_ENV_VAR;
-pub use codex_core::auth::OPENAI_API_KEY_ENV_VAR;
-pub use codex_core::auth::login_with_api_key;
-pub use codex_core::auth::logout;
-pub use codex_core::auth::save_auth;
-pub use codex_core::token_data::TokenData;
+pub use token_data::TokenData;

codex-rs/login/src/server.rs

@@ -23,18 +23,18 @@ use std::sync::Arc;
 use std::thread;
 use std::time::Duration;
 
+use crate::auth::AuthCredentialsStoreMode;
+use crate::auth::AuthDotJson;
+use crate::auth::save_auth;
 use crate::pkce::PkceCodes;
 use crate::pkce::generate_pkce;
+use crate::token_data::TokenData;
+use crate::token_data::parse_chatgpt_jwt_claims;
 use base64::Engine;
 use chrono::Utc;
 use codex_app_server_protocol::AuthMode;
 use codex_client::build_reqwest_client_with_custom_ca;
 use codex_client::originator;
-use codex_core::auth::AuthCredentialsStoreMode;
-use codex_core::auth::AuthDotJson;
-use codex_core::auth::save_auth;
-use codex_core::token_data::TokenData;
-use codex_core::token_data::parse_chatgpt_jwt_claims;
 use rand::RngCore;
 use serde_json::Value as JsonValue;
 use tiny_http::Header;

codex-rs/login/tests/suite/device_code_login.rs

@@ -3,9 +3,9 @@
 use anyhow::Context;
 use base64::Engine;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use codex_core::auth::AuthCredentialsStoreMode;
-use codex_core::auth::load_auth_dot_json;
 use codex_login::ServerOptions;
+use codex_login::auth::AuthCredentialsStoreMode;
+use codex_login::auth::load_auth_dot_json;
 use codex_login::run_device_code_login;
 use serde_json::json;
 use std::sync::Arc;

codex-rs/login/tests/suite/login_server_e2e.rs

@@ -7,8 +7,8 @@ use std::time::Duration;
 
 use anyhow::Result;
 use base64::Engine;
-use codex_core::auth::AuthCredentialsStoreMode;
 use codex_login::ServerOptions;
+use codex_login::auth::AuthCredentialsStoreMode;
 use codex_login::run_login_server;
 use core_test_support::skip_if_no_network;
 use tempfile::tempdir;