mirror of
https://github.com/openai/codex.git
synced 2026-10-19 17:28:46 +00:00
Nick Steele
4994306e9f
## Why The app server previously rejected OAuth login for enterprise-managed MCP servers. These servers need an explicit sign-in flow that ties saved authorization to the active Codex user and workspace and prevents canceled or superseded attempts from saving credentials. ## What changed - Enable enterprise sign-in through `mcpServer/oauth/login` for configured servers with a connected thread, trusted IdP registration, and `features.use_xaa` enabled. Scope shared enterprise credentials by user, workspace, issuer, and client ID. - Add `loginId` to MCP OAuth login responses and completion notifications, preserving compatibility with older servers that omit it. - Support enterprise login replacement and `account/login/cancel`, wait for callback listener shutdown before replacement, and recheck account and configuration before saving grants. Fence stale attempts across processes and account changes. - Remove shared enterprise authorization during account logout and `codex mcp logout`, including when the feature is disabled. Continue account logout if enterprise cleanup fails, and invalidate MCP runtimes on account changes. Start a fresh session after successful enterprise sign-in to use the saved grant. ## Testing Add regression coverage for login replacement and cancellation, callback port reuse, account changes during setup, cross-process logout invalidation, persisted workspace policy selection, cleanup failures, and responses from older servers without `loginId`. GitOrigin-RevId: 7ed4caaab4659ed1e67064262cf5cee48e3a26ac
OpenAI Codex Python SDK
Build Python applications that start Codex threads, run turns, stream progress, and control workspace access.
Install
Install the SDK:
pip install openai-codex
Quickstart
The SDK reuses your existing Codex authentication when one is already available:
from openai_codex import Codex
with Codex() as codex:
thread = codex.thread_start()
result = thread.run("Explain this repository in three bullets.")
print(result.final_response)
thread.run(...) returns a TurnResult containing the final response,
collected items, and token usage.
Authentication
Existing Codex authentication is reused automatically. To start ChatGPT browser login explicitly:
from openai_codex import Codex
with Codex() as codex:
login = codex.login_chatgpt()
print(login.auth_url)
print(login.wait().success)
For device-code login:
with Codex() as codex:
login = codex.login_chatgpt_device_code()
print(login.verification_url, login.user_code)
login.wait()
For API-key login:
with Codex() as codex:
codex.login_api_key("sk-...")
Built-In Help
Use Python's standard help(openai_codex), help(Codex), or
python -m pydoc openai_codex documentation tools.
Documentation
The package is licensed under the repository Apache License 2.0.