From 9129d0cba1d3950ea8615a13796c8fb0523d64af Mon Sep 17 00:00:00 2001
From: Cooper Gamble <cooper@openai.com>
Date: Wed, 17 Jun 2026 11:08:45 +0000
Subject: [PATCH] [codex] prevent api-only bootstrap from using WIF [ci
 changed_files]

---
 codex-rs/config/src/config_toml.rs | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/codex-rs/config/src/config_toml.rs b/codex-rs/config/src/config_toml.rs
index 4bceb0cb95..9ce0e0da4a 100644
--- a/codex-rs/config/src/config_toml.rs
+++ b/codex-rs/config/src/config_toml.rs
@@ -735,6 +735,10 @@ impl ConfigToml {
     /// Unknown provider IDs fail closed here; normal config loading will emit
     /// the more specific provider-not-found error later.
     pub fn workload_identity_for_cloud_config(&self) -> Option<WorkloadIdentityConfig> {
+        if self.forced_login_method == Some(ForcedLoginMethod::Api) {
+            return None;
+        }
+
         let provider_id = self.model_provider.as_deref().unwrap_or(OPENAI_PROVIDER_ID);
         let openai_base_url = self
             .openai_base_url
@@ -1036,6 +1040,17 @@ mod tests {
         assert_eq!(config.workload_identity_for_cloud_config(), None);
     }
 
+    #[test]
+    fn cloud_config_skips_workload_identity_when_api_login_is_forced() {
+        let config = ConfigToml {
+            forced_login_method: Some(ForcedLoginMethod::Api),
+            workload_identity: Some(workload_identity()),
+            ..Default::default()
+        };
+
+        assert_eq!(config.workload_identity_for_cloud_config(), None);
+    }
+
     #[test]
     fn cloud_config_workload_identity_fails_closed_for_unknown_provider() {
         let workload_identity = workload_identity();