openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-23 18:08:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add secret_key option to model provider definition

Browse Source
This commit is contained in:
Michael Bolin
2025-10-21 11:18:09 -07:00
parent da82153a8d
commit ce366d6f53
9 changed files with 39 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/client.rs
+6
View File
@@ -1093,6 +1093,7 @@ mod tests {
base_url: Some("https://test.com".to_string()),
env_key: Some("TEST_API_KEY".to_string()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -1156,6 +1157,7 @@ mod tests {
base_url: Some("https://test.com".to_string()),
env_key: Some("TEST_API_KEY".to_string()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -1192,6 +1194,7 @@ mod tests {
base_url: Some("https://test.com".to_string()),
env_key: Some("TEST_API_KEY".to_string()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -1230,6 +1233,7 @@ mod tests {
base_url: Some("https://test.com".to_string()),
env_key: Some("TEST_API_KEY".to_string()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -1264,6 +1268,7 @@ mod tests {
base_url: Some("https://test.com".to_string()),
env_key: Some("TEST_API_KEY".to_string()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -1367,6 +1372,7 @@ mod tests {
base_url: Some("https://test.com".to_string()),
env_key: Some("TEST_API_KEY".to_string()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/src/config.rs
+1
View File
@@ -2801,6 +2801,7 @@ model_verbosity = "high"
env_key: Some("OPENAI_API_KEY".to_string()),
wire_api: crate::WireApi::Chat,
env_key_instructions: None,
secret_key: None,
query_params: None,
http_headers: None,
env_http_headers: None,
codex-rs/core/src/model_provider_info.rs
+24 -8
View File
@@ -49,6 +49,11 @@ pub struct ModelProviderInfo {
/// Environment variable that stores the user's API key for this provider.
pub env_key: Option<String>,
/// The value of the key to use with the provider. Use of this config is
/// discouraged in favor of `env_key` for security reasons, but this may
/// be necessary when using this programmatically.
pub secret_key: Option<String>,
/// Optional instructions to help the user get a valid value for the
/// variable and set it.
pub env_key_instructions: Option<String>,
@@ -102,14 +107,18 @@ impl ModelProviderInfo {
client: &'a reqwest::Client,
auth: &Option<CodexAuth>,
) -> crate::error::Result<reqwest::RequestBuilder> {
let effective_auth = match self.api_key() {
Ok(Some(key)) => Some(CodexAuth::from_api_key(&key)),
Ok(None) => auth.clone(),
Err(err) => {
if auth.is_some() {
auth.clone()
} else {
return Err(err);
let effective_auth = if let Some(secret_key) = &self.secret_key {
Some(CodexAuth::from_api_key(secret_key))
} else {
match self.api_key() {
Ok(Some(key)) => Some(CodexAuth::from_api_key(&key)),
Ok(None) => auth.clone(),
Err(err) => {
if auth.is_some() {
auth.clone()
} else {
return Err(err);
}
}
}
};
@@ -274,6 +283,7 @@ pub fn built_in_model_providers() -> HashMap<String, ModelProviderInfo> {
.filter(|v| !v.trim().is_empty()),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: Some(
@@ -333,6 +343,7 @@ pub fn create_oss_provider_with_base_url(base_url: &str) -> ModelProviderInfo {
base_url: Some(base_url.into()),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Chat,
query_params: None,
http_headers: None,
@@ -372,6 +383,7 @@ base_url = "http://localhost:11434/v1"
base_url: Some("http://localhost:11434/v1".into()),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Chat,
query_params: None,
http_headers: None,
@@ -399,6 +411,7 @@ query_params = { api-version = "2025-04-01-preview" }
base_url: Some("https://xxxxx.openai.azure.com/openai".into()),
env_key: Some("AZURE_OPENAI_API_KEY".into()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Chat,
query_params: Some(maplit::hashmap! {
"api-version".to_string() => "2025-04-01-preview".to_string(),
@@ -429,6 +442,7 @@ env_http_headers = { "X-Example-Env-Header" = "EXAMPLE_ENV_VAR" }
base_url: Some("https://example.com".into()),
env_key: Some("API_KEY".into()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Chat,
query_params: None,
http_headers: Some(maplit::hashmap! {
@@ -455,6 +469,7 @@ env_http_headers = { "X-Example-Env-Header" = "EXAMPLE_ENV_VAR" }
base_url: Some(base_url.into()),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -487,6 +502,7 @@ env_http_headers = { "X-Example-Env-Header" = "EXAMPLE_ENV_VAR" }
base_url: Some("https://example.com".into()),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/tests/chat_completions_payload.rs
+1
View File
@@ -50,6 +50,7 @@ async fn run_request(input: Vec<ResponseItem>) -> Value {
base_url: Some(format!("{}/v1", server.uri())),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Chat,
query_params: None,
http_headers: None,
codex-rs/core/tests/chat_completions_sse.rs
+1
View File
@@ -49,6 +49,7 @@ async fn run_stream_with_bytes(sse_body: &[u8]) -> Vec<ResponseEvent> {
base_url: Some(format!("{}/v1", server.uri())),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Chat,
query_params: None,
http_headers: None,
codex-rs/core/tests/responses_headers.rs
+1
View File
@@ -38,6 +38,7 @@ async fn responses_stream_includes_task_type_header() {
base_url: Some(format!("{}/v1", server.uri())),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/tests/suite/client.rs
+3
View File
@@ -632,6 +632,7 @@ async fn azure_responses_request_includes_store_and_reasoning_ids() {
base_url: Some(format!("{}/openai", server.uri())),
env_key: None,
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -1115,6 +1116,7 @@ async fn azure_overrides_assign_properties_used_for_responses_url() {
base_url: Some(format!("{}/openai", server.uri())),
// Reuse the existing environment variable to avoid using unsafe code
env_key: Some(existing_env_var_with_random_value.to_string()),
secret_key: None,
query_params: Some(std::collections::HashMap::from([(
"api-version".to_string(),
"2025-04-01-preview".to_string(),
@@ -1197,6 +1199,7 @@ async fn env_var_overrides_loaded_auth() {
"2025-04-01-preview".to_string(),
)])),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
http_headers: Some(std::collections::HashMap::from([(
"Custom-Header".to_string(),
codex-rs/core/tests/suite/stream_error_allows_next_turn.rs
+1
View File
@@ -66,6 +66,7 @@ async fn continue_after_stream_error() {
base_url: Some(format!("{}/v1", server.uri())),
env_key: Some("PATH".into()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/tests/suite/stream_no_completed.rs
+1
View File
@@ -73,6 +73,7 @@ async fn retries_on_early_close() {
// provider is not set.
env_key: Some("PATH".into()),
env_key_instructions: None,
secret_key: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,