What shipped in OpenAI on August 26, 2026?

Part 3 of 5 is live, and OpenAIs Node SDK just got its most significant auth upgrade in years. In total, 62 commits, 71 pull requests, and 3 releases landed.

Who contributed to OpenAI on August 26, 2026?

5 developers shipped this update, including copyberry, george, Hayden, Justin Beckwith, and apcha-oai.

What were the notable OpenAI updates?

feat(auth): add pinned X.509 workload token exchange (#2470), feat(auth): attest cross-module X.509 transport capabilities (#2471), and feat(auth): integrate attested X.509 workload identity into clients (#2472).

Aug 26, 2026

$ the-wire · showcase

X.509 Workload Identity Lands in openai-node

By RepoJournal · Filed 06:57 UTC on August 26, 2026 · About OpenAI · Composed from the cited sources · methodology

5 people shipped this

copyberry @copyberry 5 cited

Justin Beckwith @jbeckwith-oai 3 cited

apcha-oai @apcha-oai 2 cited

george @huanglianggit 1 cited

Hayden @HAYDEN-OAI 1 cited

Part 3 of 5 is live, and OpenAIs Node SDK just got its most significant auth upgrade in years.

The openai-node SDK is rolling out pinned X.509 workload identity, with three parts of a five-part stack merged overnight [1][2][3]. Part 1 adds certificate-authenticated OAuth exchange against the single approved mtls.auth.openai.com issuer [1], while Part 2 introduces a frozen transport capability registry shared across CJS and ESM [2]. Part 3 wires it all into the client, pinning the global mTLS API origin and excluding Azure, Bedrock, and custom dispatchers [3]. Expect breaking changes as this matures. Across the stack, Codex hardened managed worktrees with thread ownership metadata and atomic no-clobber writes [4], and sanitized Git remote credentials before they enter thread and turn metadata [5]. "Git remote URLs can embed usernames, passwords, or tokens," notes the Codex PR [5]. openai-python also gained generated request encoding for Realtime WebRTC setup [6] and project residency config with deprecated geography [7]. The Node SDK broke ecosystem CLI checks to run on Windows [8] and fixed Castiron checks for external-fork PRs [9]. Codex added an explicit remote executor connection refresh for planned replacement [10] and tracks image generation request IDs in analytics [11], while moving relay test helpers into shared support [12].

Action items

→ Review the X.509 workload-identity PRs and plan for migration; parts 4 and 5 are coming openai/openai-node [plan]
→ Patch Codex to sanitize Git remote credentials before storing metadata openai/codex [immediate]
→ Test your Realtime WebRTC flow with openai-python 3736 to ensure SDP offers encode correctly openai/openai-python [plan]
→ Monitor the Windows ecosystem CLI test fix; run on a Windows CI to confirm portability openai/openai-node [monitor]

References

[1] feat(auth): add pinned X.509 workload token exchange (#2470) ↗ openai/openai-node
[2] feat(auth): attest cross-module X.509 transport capabilities (#2471) ↗ openai/openai-node
[3] feat(auth): integrate attested X.509 workload identity into clients (#2472) ↗ openai/openai-node
[4] Add thread ownership metadata for managed worktrees ↗ openai/codex
[5] Sanitize credentials from Git remote metadata ↗ openai/codex
[6] fix(api): encode Realtime call offers and session configuration ↗ openai/openai-python
[7] feat(api): add project residency configuration and cost quantity units ↗ openai/openai-python
[8] test: make ecosystem CLI checks portable on Windows (#2431) ↗ openai/openai-node
[9] fix: publish Castiron checks for external-fork pull requests (#2464) ↗ openai/openai-node
[10] Add explicit remote executor connection refresh ↗ openai/codex
[11] Track image generation request IDs in analytics ↗ openai/codex
[12] Move relay helpers into exec-server test support ↗ openai/codex