AllAi Codex Authenticator

@osf.digital/allai-codex-authenticator is the Node.js/NPM distribution of the allai-codex-authenticator CLI. This package ships prebuilt binaries of the Rust implementation (allai-codex-authenticator-rs) for supported platforms and exposes a single executable named allai-codex-authenticator.

Installation

You need Node.js 16+!

# npm
npm install --global @osf.digital/allai-codex-authenticator@latest

# Volta
volta install @osf.digital/allai-codex-authenticator@latest

Usage

allai-codex-authenticator [--proxy-port <port>]

| Flag | Default | Description | |------|---------|-------------| | --proxy-port | 2271 | Port exposed by the local Pingora proxy (http://127.0.0.1:<proxy-port>/v1). The CLI also rewrites ~/.codex/config.toml so the Codex CLI talks to this endpoint. |

The command is interactive: it draws a console UI, shows spinners for each stage, and may prompt to confirm config changes or updates.

What the tool does for you

1. Checks for updates. Checks the npm registry for @osf.digital/allai-codex-authenticator and prompts you to upgrade if a newer version exists.
2. Validates Codex config. Ensures ~/.codex/config.toml contains the osfdigital provider with base URL http://127.0.0.1:<proxy-port>/v1 and wire API responses. If missing or outdated, it shows you a colorized diff and asks before writing changes.
3. Authenticates you. Spins up a local OAuth callback server to walk you through a browser login to the OSF Digital Azure AD tenant.
4. Runs the proxy. Boots a Pingora reverse proxy that forwards http://127.0.0.1:<proxy-port>/v1/* to https://codex.allai.digital/v1/*, automatically injecting the bearer token and refreshing it if needed.
5. Logs the errors. Logs are kept and rotated daily under ~/.osfdigital/allai-codex-authenticator/logs/.

Keep the CLI process running while you interact with the Codex CLI or IDE plugins; stop it with Ctrl+C when you are done.

Typical workflow

1. Install the package globally via NPM/Volta.
2. Run allai-codex-authenticator. Accept the Codex config diff if this is your first time.
3. Authenticate in the browser when prompted. The CLI opens http://localhost:2270 and handles the OAuth redirect automatically.
4. Leave the window/process open. Your Codex tooling should now target the local proxy.
5. Stop the proxy with Ctrl+C or by closing the terminal.

Supported platforms

• macOS (arm64 / Apple Silicon, and x64 / Intel)
• Windows x64 (MSVC)

Troubleshooting

• Port already in use: Pass --proxy-port with free values.
• Need to inspect failures: Read ~/.osfdigital/allai-codex-authenticator/logs/trace.log after the CLI prompts you with a [ ! ], Log: ..., Err: ... message.