22 lines
1.2 KiB
Markdown
22 lines
1.2 KiB
Markdown
# Next Steps — Codex App Server: Embeddable Agent Protocol & BYO Auth
|
|
|
|
> Part of [[codex-app-server-byo-auth/index|Codex App Server — Embeddable Agent Protocol & BYO Auth]]
|
|
|
|
## Decisions pending
|
|
|
|
- [ ] Pick the target app shape first: local/desktop (stable, recommended) vs hosted multi-tenant (experimental transport, more work)
|
|
- [ ] For hosted: decide key placement — user's browser (localStorage) vs your DB vs Codex-managed device-code tokens
|
|
- [ ] For hosted: contact OpenAI for the known-clients list / compliance assessment before building for enterprise
|
|
|
|
## Build considerations
|
|
|
|
- [ ] Prototype the device-code flow with a minimal app-server client (Node/TS) to validate the no-sign-in UX
|
|
- [ ] Design the provider adapter interface (Effect Layer): `ApiKeyProvider` vs `ChatGptAuthProvider`
|
|
- [ ] Evaluate per-version bindings (`generate-ts` / `generate-json-schema`) for type safety
|
|
- [ ] Consider Codex SDK for any CI/headless automation needs (separate from app-server embedding)
|
|
|
|
## Open questions
|
|
|
|
- [ ] Does OpenAI's BYO-ChatGPT posture change over time? (monitor; Anthropic precedent exists)
|
|
- [ ] What's the real token-refresh behavior of `chatgptAuthTokens` mode in production?
|
|
- [ ] Rate-limit surfacing: which plan limits matter per target user base?
|