0xrsydn/research
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
research/codex-app-server-byo-auth/next-steps.md

1.2 KiB
Raw Permalink Blame History

Next Steps — Codex App Server: Embeddable Agent Protocol & BYO Auth

Part of codex-app-server-byo-auth/index

Decisions pending

  • Pick the target app shape first: local/desktop (stable, recommended) vs hosted multi-tenant (experimental transport, more work)
  • For hosted: decide key placement — user's browser (localStorage) vs your DB vs Codex-managed device-code tokens
  • For hosted: contact OpenAI for the known-clients list / compliance assessment before building for enterprise

Build considerations

  • Prototype the device-code flow with a minimal app-server client (Node/TS) to validate the no-sign-in UX
  • Design the provider adapter interface (Effect Layer): ApiKeyProvider vs ChatGptAuthProvider
  • Evaluate per-version bindings (generate-ts / generate-json-schema) for type safety
  • Consider Codex SDK for any CI/headless automation needs (separate from app-server embedding)

Open questions

  • Does OpenAI's BYO-ChatGPT posture change over time? (monitor; Anthropic precedent exists)
  • What's the real token-refresh behavior of chatgptAuthTokens mode in production?
  • Rate-limit surfacing: which plan limits matter per target user base?