cooper-oai f39e45e4a6 Support API workload identity authentication (#59275) ...

## Why

Workload identity authentication assumed every token exchange resolved to ChatGPT, preventing API service accounts from using the same flow.

## What changed

- Accept `wif_product: "api"` responses with organization, project, and service account metadata. Preserve ChatGPT compatibility when `wif_product` is omitted.
- Resolve API workload identity tokens as API key authentication and apply login restrictions to the resolved product. Read the actual login status during TUI startup instead of assuming ChatGPT.
- Preserve auth ownership across token renewal for the same API identity, and reject product or identity changes during refresh.
- Redact API keys from debug output.

## Testing

Add coverage for both exchange products, malformed metadata, assertion rotation and unauthorized recovery, identity changes, login and workspace restrictions, and CLI login status under both forced login methods.

GitOrigin-RevId: f4fc4da74b86e4a9ae47b28221d3e065500f5b6e

2026-11-04 00:52:58 +00:00

..

e2e_benches

bench: add codex help e2e macrobenchmark (#31295)

2026-07-09 17:23:44 -07:00

src

Add stdin bearer authentication for exec-server registration (#59254)

2026-11-03 23:22:28 +00:00

tests

Support API workload identity authentication (#59275)

2026-11-04 00:52:58 +00:00

BUILD.bazel

Isolate daemon package tests to reduce disk contention (#53897)

2026-10-14 07:13:22 +00:00

build.rs

Add WebRTC media transport to realtime TUI (#17058)

2026-04-08 10:26:55 -07:00

Cargo.toml

Add a standalone codex-exec-server executable (#57589)

2026-10-27 23:13:53 +00:00