# Next Steps — Codex App Server: Embeddable Agent Protocol & BYO Auth

> Part of [[codex-app-server-byo-auth/index|Codex App Server — Embeddable Agent Protocol & BYO Auth]]

## Decisions pending

- [ ] Pick the target app shape first: local/desktop (stable, recommended) vs hosted multi-tenant (experimental transport, more work)
- [ ] For hosted: decide key placement — user's browser (localStorage) vs your DB vs Codex-managed device-code tokens
- [ ] For hosted: contact OpenAI for the known-clients list / compliance assessment before building for enterprise

## Build considerations

- [ ] Prototype the device-code flow with a minimal app-server client (Node/TS) to validate the no-sign-in UX
- [ ] Design the provider adapter interface (Effect Layer): `ApiKeyProvider` vs `ChatGptAuthProvider`
- [ ] Evaluate per-version bindings (`generate-ts` / `generate-json-schema`) for type safety
- [ ] Consider Codex SDK for any CI/headless automation needs (separate from app-server embedding)

## Open questions

- [ ] Does OpenAI's BYO-ChatGPT posture change over time? (monitor; Anthropic precedent exists)
- [ ] What's the real token-refresh behavior of `chatgptAuthTokens` mode in production?
- [ ] Rate-limit surfacing: which plan limits matter per target user base?