feat: add OpenAI Codex OAuth PKCE install flow by eureka928 · Pull Request #1129 · eigent-ai/eigent

eureka928 · 2026-02-02T20:49:26Z

Description

This PR adds support for installing and authenticating OpenAI Codex as a tool via OAuth PKCE flow. Users can install Codex from both the Settings/MCP page and the AddWorker tool selection, with automatic token management including refresh and expiry handling.

Closes #834

Key Changes:

Backend (backend/):

app/utils/toolkit/codex_toolkit.py — New CodexOAuthManager implementing the full OpenAI OAuth PKCE flow (authorization URL generation, token exchange, refresh, revocation, and persistent token storage via keyring)
app/controller/tool_controller.py — New endpoints for Codex install, uninstall, save-token, and status; integrated into existing /install/{tool} and /uninstall/{tool} routes

Server (server/):

app/model/config/config.py — Added CODEX config group with OPENAI_API_KEY environment variable mapping
app/type/config_group.py — Registered codex in ConfigGroup enum and CONFIG_GROUP_ENV_VARS

Frontend (src/):

src/pages/Setting/MCP.tsx — Codex card in Settings with install/uninstall buttons and OAuth callback handling
src/components/AddWorker/ToolSelect.tsx — Codex option in worker tool selection with installed state detection
src/hooks/useIntegrationManagement.ts — Codex integration status hook
src/components/IntegrationList/index.tsx — Codex entry in integration list

Files Changed:

backend/app/controller/tool_controller.py
backend/app/utils/toolkit/codex_toolkit.py (new)
server/app/model/config/config.py
server/app/type/config_group.py
src/components/AddWorker/ToolSelect.tsx
src/components/IntegrationList/index.tsx
src/hooks/useIntegrationManagement.ts
src/pages/Setting/MCP.tsx

What is the purpose of this pull request?

Bug fix
New Feature
Documentation update
Other

eureka928 · 2026-02-02T20:50:50Z

@Wendong-Fan @Pakchoioioi would you review my PR?
Thank you

eureka928 · 2026-02-02T20:51:11Z

Also, @Wendong-Fan would you check my DM on discord?
Thank you

eureka928 · 2026-02-02T23:04:40Z

Why these are cancelled?

4pmtong · 2026-02-03T09:27:49Z

Hi @eureka928! Thanks for your contribution! I'm doing a detailed review, @Pakchoioioi Could you help review the OAuth flow?

eureka928 · 2026-02-03T20:02:12Z

Fixed the testing

eureka928 · 2026-02-04T09:31:38Z

Follow up on this

bytecii

Thanks. Left some comments

src/components/AddWorker/ToolSelect.tsx

src/pages/Setting/MCP.tsx

backend/app/agent/toolkit/codex_toolkit.py

backend/app/utils/toolkit/codex_toolkit.py

backend/app/controller/tool_controller.py

backend/app/utils/toolkit/codex_toolkit.py

- Extract Codex config constants (CODEX_CONFIG_GROUP, CODEX_CONFIG_NAME, CODEX_POLL_TIMEOUT_MS) in ToolSelect.tsx - Extract CODEX_TOKEN_PATH constant and clarify CODEX_CLIENT_ID is a fixed public value in codex_toolkit.py - Simplify expires_in/expires_at: compute absolute expiry from relative value and only persist expires_at - Add FileLock around token file reads/writes to prevent parallel update races - Add TODO for response status string improvement and refactor of shared OAuth install logic - Apply formatting suggestion on codex uninstall message

eureka928 · 2026-02-05T01:11:18Z

Hi @bytecii addressed all comments

backend/app/agent/toolkit/codex_toolkit.py

backend/app/utils/toolkit/codex_toolkit.py

eureka928 · 2026-02-05T10:38:50Z

I updated all, please review again

- Extract Codex config constants (CODEX_CONFIG_GROUP, CODEX_CONFIG_NAME, CODEX_POLL_TIMEOUT_MS) in ToolSelect.tsx - Extract CODEX_TOKEN_PATH constant and clarify CODEX_CLIENT_ID is a fixed public value in codex_toolkit.py - Simplify expires_in/expires_at: compute absolute expiry from relative value and only persist expires_at - Add FileLock around token file reads/writes to prevent parallel update races - Add TODO for response status string improvement and refactor of shared OAuth install logic - Apply formatting suggestion on codex uninstall message

4pmtong

LGTM, thanks @eureka928 for contribution!

eureka928 · 2026-02-06T23:11:27Z

@bytecii @Wendong-Fan please review again

Wendong-Fan · 2026-02-06T23:53:30Z

src/hooks/useIntegrationManagement.ts

+        const hasApiKey = configs.some(
+          (c: any) =>
+            c.config_group?.toLowerCase() === 'codex' &&
+            c.config_name === 'OPENAI_API_KEY' &&


This check won't work - looking at config.py, Codex has env_vars: [] and stores the API key via Provider API, not as a config. So OPENAI_API_KEY will never exist in the codex config group.

We need to either save a marker config after OAuth (like Google Calendar does with GOOGLE_REFRESH_TOKEN), or check providers instead.

Wendong-Fan · 2026-02-06T23:53:30Z

src/pages/Setting/MCP.tsx

+                const response = await fetchPost('/install/tool/codex');
+                if (response.success) {
+                  toast.success(t('setting.codex-installed-successfully'));
+                  await saveCodexAsProvider(response);


Missing marker config save here. Google Calendar saves GOOGLE_REFRESH_TOKEN after OAuth to track install state, but Codex doesn't save anything. This means the UI will never show Codex as installed.

Wendong-Fan · 2026-02-06T23:53:30Z

backend/app/agent/toolkit/codex_toolkit.py

+        """
+        path = cls._token_path()
+        try:
+            if "saved_at" not in token_data:


nit: mutating the input dict directly (.pop(), key assignments) could cause issues if the caller reuses it. Consider working on a copy: data = token_data.copy()

Wendong-Fan · 2026-02-06T23:55:31Z

server/app/model/config/config.py

+        # OpenAI API key).  After OAuth the key is stored via the
+        # Provider API, not here.  The entry is kept only for
+        # install-state detection in the integration list UI.
+        ConfigGroup.CODEX.value: {


following up on my earlier comment, this entry acknowledges Codex is a provider (toolkit: None, type: provider), yet it still lives in ConfigInfo.configs alongside actual toolkits and appears in the MCP & Tools UI.

Suggestion: move the Codex OAuth entry point to Model/Provider settings page, since its purpose is obtaining an OpenAI API key for model access, not providing agent tools.

Wendong-Fan

hey @eureka928 ,

Codex is explicitly marked as a provider, yet this PR still places it in MCP & Tools UI (MCP.tsx, ToolSelect.tsx, IntegrationList).

I saw the TODO comment in the code:

  # TODO: Codex is a model-provider integration, not a toolkit.
  # Its OAuth entry point should move to the Model/Provider settings page.

but since Codex OAuth should belongs in the Models/Provider settings page, not in MCP & Tools where users expect callable agent tools.

This should be fixed before merging rather than left as technical debt

Implements Authorization Code + PKCE flow using Codex CLI's public client_id. Handles background OAuth via localhost callback server, token persistence at ~/.eigent/tokens/codex/, and refresh logic.

Add codex handling to install_tool and uninstall_tool endpoints. Add POST /codex/save-token for manual API key fallback and GET /codex/status for token status. Add Codex to available tools list.

Add CODEX enum to ConfigGroup and corresponding entry in ConfigInfo.configs with OPENAI_API_KEY env var and codex_oauth toolkit.

Add Codex config check in useIntegrationManagement for installed state and uninstall cleanup. Add Codex case in IntegrationList handleInstall to trigger onInstall directly without env dialog.

Add Codex onInstall handler with OAuth status polling in MCP.tsx settings page and ToolSelect.tsx AddWorker flow, following the existing Google Calendar authorization pattern.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-authored-by: bytecii <994513625@qq.com>

- Extract Codex config constants (CODEX_CONFIG_GROUP, CODEX_CONFIG_NAME, CODEX_POLL_TIMEOUT_MS) in ToolSelect.tsx - Extract CODEX_TOKEN_PATH constant and clarify CODEX_CLIENT_ID is a fixed public value in codex_toolkit.py - Simplify expires_in/expires_at: compute absolute expiry from relative value and only persist expires_at - Add FileLock around token file reads/writes to prevent parallel update races - Add TODO for response status string improvement and refactor of shared OAuth install logic - Apply formatting suggestion on codex uninstall message

- Add Fernet encryption for token storage using cryptography library - Derive encryption key from machine-specific identifiers (username, hostname, machine-id) using PBKDF2HMAC with 100k iterations - Set restrictive file permissions (0600) on encrypted token file - Tokens tied to specific machine for additional security

…t config Address review feedback: Codex OAuth obtains an OpenAI API key for model access, not agent tools. After successful OAuth, the key is now saved via the Provider API (/api/provider) so it integrates with the model provider configuration system. Changes: - Backend: return access_token in Codex install response for provider storage - Frontend: replace /api/configs storage with /api/provider for Codex - Server: mark CODEX ConfigInfo entry as type=provider with empty env_vars - i18n: add missing codex translation keys, remove verbose t() fallback pattern - Fix stray merge conflict marker in ToolSelect.tsx - Remove debug console.log statements from MCP.tsx

- Save CODEX_OAUTH_TOKEN marker config after OAuth to track install state - Check marker config instead of OPENAI_API_KEY for install detection - Avoid mutating input dict in CodexOAuthManager.save_token() - Add CODEX_OAUTH_TOKEN to Codex env_vars whitelist in server config - Prioritize named integration descriptions over env_vars fallback

Codex OAuth is a model-provider integration, not a toolkit. Remove it from ConfigInfo.configs so it no longer appears in the /api/config/info response that drives the MCP & Tools UI. Also remove Codex-specific install detection and uninstall handling from useIntegrationManagement and IntegrationList.

Remove the entire Codex onInstall handler, saveCodexAsProvider, and saveCodexMarkerConfig helpers from MCP.tsx and ToolSelect.tsx. Extract OAuth polling constants (OAUTH_POLL_INTERVAL_MS, OAUTH_POLL_TIMEOUT_MS) to replace inline magic numbers in the remaining Google Calendar flow. Add TODO for status string enum extraction.

Add a "Connect via Codex" button to the OpenAI BYOK provider panel in the Models settings page. The OAuth PKCE flow obtains an OpenAI API key and saves it as a provider, with a marker config for state detection. - Add handleCodexOAuth, saveCodexAsProvider, handleCodexDisconnect - Extract refreshProviderForm helper to deduplicate provider list sync - Show "or" divider between Codex OAuth and manual API key entry - Disconnect properly revokes token, removes marker, and resets provider - Add i18n keys for connect/disconnect/status UI text

eureka928 · 2026-02-08T02:30:31Z

@Wendong-Fan please review again, I addressed all comments

Wendong-Fan

seems it's still organized as one toolkit?

eureka928 force-pushed the feat/codex-oauth branch from 6c8f1c0 to 30877f8 Compare February 2, 2026 22:33

4pmtong requested review from 4pmtong, Pakchoioioi and Wendong-Fan February 3, 2026 09:17

eureka928 force-pushed the feat/codex-oauth branch from 30877f8 to e64c519 Compare February 3, 2026 19:44

eureka928 force-pushed the feat/codex-oauth branch 2 times, most recently from f33d37b to bdbc3e3 Compare February 4, 2026 09:11

Wendong-Fan requested a review from bytecii February 4, 2026 22:22

bytecii reviewed Feb 4, 2026

View reviewed changes

4pmtong reviewed Feb 5, 2026

View reviewed changes

backend/app/agent/toolkit/codex_toolkit.py Show resolved Hide resolved

eureka928 requested a review from 4pmtong February 5, 2026 04:54

4pmtong reviewed Feb 5, 2026

View reviewed changes

backend/app/agent/toolkit/codex_toolkit.py Show resolved Hide resolved

bytecii reviewed Feb 5, 2026

View reviewed changes

backend/app/agent/toolkit/codex_toolkit.py Show resolved Hide resolved

backend/app/utils/toolkit/codex_toolkit.py Outdated Show resolved Hide resolved

eureka928 requested review from 4pmtong and bytecii February 5, 2026 10:38

eureka928 force-pushed the feat/codex-oauth branch from 5326462 to bdaec62 Compare February 5, 2026 10:39

eureka928 force-pushed the feat/codex-oauth branch from bdaec62 to 89cf2bc Compare February 5, 2026 15:53

4pmtong approved these changes Feb 6, 2026

View reviewed changes

Wendong-Fan added this to the Sprint 13 milestone Feb 6, 2026

Wendong-Fan reviewed Feb 6, 2026

View reviewed changes

Wendong-Fan reviewed Feb 7, 2026

View reviewed changes

eureka928 and others added 20 commits February 8, 2026 03:21

feat: add CodexOAuthManager for OpenAI Codex PKCE OAuth flow

b5ec7c8

Implements Authorization Code + PKCE flow using Codex CLI's public client_id. Handles background OAuth via localhost callback server, token persistence at ~/.eigent/tokens/codex/, and refresh logic.

feat: add Codex install/uninstall/save-token/status endpoints

be83a3b

Add codex handling to install_tool and uninstall_tool endpoints. Add POST /codex/save-token for manual API key fallback and GET /codex/status for token status. Add Codex to available tools list.

feat: add Codex config group and OPENAI_API_KEY env var mapping

8ea1c5b

Add CODEX enum to ConfigGroup and corresponding entry in ConfigInfo.configs with OPENAI_API_KEY env var and codex_oauth toolkit.

feat: add Codex installed detection, uninstall, and install handling

85c39c6

Add Codex config check in useIntegrationManagement for installed state and uninstall cleanup. Add Codex case in IntegrationList handleInstall to trigger onInstall directly without env dialog.

feat: add Codex OAuth install flow in Settings and AddWorker

0287b6f

Add Codex onInstall handler with OAuth status polling in MCP.tsx settings page and ToolSelect.tsx AddWorker flow, following the existing Google Calendar authorization pattern.

style: fix pre-commit lint errors (E501, yapf formatting)

41d962d

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

fix: replace undefined Optional with int | None in CodexTokenRequest

46b1d3d

Update backend/app/controller/tool_controller.py

2bf3a19

Co-authored-by: bytecii <994513625@qq.com>

style: apply ruff formatting fixes

a56b4ac

refactor: move imports to top of codex_toolkit.py

ee747e8

test: add unit tests for codex_toolkit.py

bea4a21

feat: add OAuth state parameter for CSRF protection

cfad374

fix: add missing blank line to pass ruff lint

dfa163f

eureka928 force-pushed the feat/codex-oauth branch from cbd18cf to 4fe2bea Compare February 8, 2026 02:24

fix: remove unused Optional import to pass ruff lint

b28d970

eureka928 requested a review from Wendong-Fan February 8, 2026 02:29

Wendong-Fan reviewed Feb 8, 2026

View reviewed changes

Wendong-Fan added the Waiting for Update label Feb 8, 2026

Conversation

eureka928 commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What is the purpose of this pull request?

Uh oh!

eureka928 commented Feb 2, 2026

Uh oh!

eureka928 commented Feb 2, 2026

Uh oh!

eureka928 commented Feb 2, 2026

Uh oh!

4pmtong commented Feb 3, 2026

Uh oh!

eureka928 commented Feb 3, 2026

Uh oh!

eureka928 commented Feb 4, 2026

Uh oh!

bytecii left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eureka928 commented Feb 5, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eureka928 commented Feb 5, 2026

Uh oh!

4pmtong left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eureka928 commented Feb 6, 2026

Uh oh!

Wendong-Fan Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Wendong-Fan Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Wendong-Fan Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Wendong-Fan Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Wendong-Fan left a comment

Choose a reason for hiding this comment

Uh oh!

eureka928 commented Feb 8, 2026

Uh oh!

Wendong-Fan left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

eureka928 commented Feb 2, 2026 •

edited

Loading

4pmtong left a comment •

edited

Loading

Wendong-Fan Feb 6, 2026 •

edited

Loading

Wendong-Fan Feb 6, 2026 •

edited

Loading