$ the-wire · showcase
Codex scopes credential substitution, adds Windows proxy auth
By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology
Codex tightened where it will inject host secrets into proxied requests and added enterprise auth paths for Windows proxies and managed MCP servers, while both SDKs gained Vertex AI support for the Responses API.
Scope MITM credential substitution to trusted origins and placeholders (#56003) openai/codex
Credential substitution for MITM'd traffic now requires the destination and the original request to be authorized before host secrets are exposed, with new hook `schemes` and `ports` constraints and an exact whole-header `placeholder` match. Project configuration can no longer redirect trusted credential policies, and older clients reject scoped policies instead of silently applying uncondition...
Retry proxy CONNECT challenges with Windows authentication openai/codex
HTTPS requests and WebSocket connections on Windows now retry proxy `CONNECT` challenges through the existing Windows authentication helper using the signed-in user's Negotiate or NTLM credentials. An origin `407` is treated as a normal HTTP response, and authenticated tunnels reach the HTTP client over destination-specific named pipes.
feat: add Vertex AI support for the Responses API openai/openai-node
A new `vertex(...)` helper lets the standard `OpenAI` client call the Responses API through Google Vertex AI, authenticating with Application Default Credentials, an existing Google auth client, or an application-managed bearer token. `google-auth-library` stays optional, so callback authentication works in bundled applications without it.
feat: add Vertex AI support for the Responses API openai/openai-python
The Python SDK gets the same `vertex(...)` path for `OpenAI` and `AsyncOpenAI`, configured by project and location or an explicit API root. Default and explicit Google credentials require the optional `openai[vertex]` extra, while token callbacks work on the base package; credentials are bound to the configured origin and redirects are disabled.
Support confidential OAuth clients for enterprise-managed MCP auth openai/codex
Enterprise-managed MCP auth no longer requires public OAuth clients at both the identity provider and the MCP authorization server. Codex accepts separate `client_secret` and `token_endpoint_auth_method` settings per registration and supports `client_secret_basic` and `client_secret_post`. The rest is housekeeping: both SDKs clarified service-account key deletion and added custom voice consent ...
