# OAuth Implementation

This proxy uses **OAuth 2.0 with PKCE** for secure authentication with ChatGPT.

## Quick Start

### Desktop (Browser)
```bash
codex-proxy account add
```

### Headless/VM (No Browser)
```bash
codex-proxy account add --no-browser
```

The legacy `codex-claude-proxy` command remains supported as an alias.

## Headless/VM Workflow

When running on a server without a browser (VM, Docker, SSH):

1. Run the command with `--no-browser`:
   ```bash
   codex-proxy account add --no-browser
   ```

2. It prints a URL like:
   ```
   https://auth.openai.com/oauth/authorize?response_type=code&...
   ```

3. Copy the URL and open it in a browser on **any other device** (your laptop, phone, etc.)

4. Complete the ChatGPT login

5. After successful login, you'll be redirected to a localhost URL that looks like:
   ```
   http://localhost:1455/auth/callback?code=ABC123...
   ```

6. Copy that entire URL (or just the `code` parameter) and paste it back in the terminal

7. The proxy exchanges the code for tokens and saves your account, replacing any existing local account

## OAuth Config

- **Client ID**: `app_EMoamEEZ73f0CkXaXp7hrann`
- **Auth URL**: `https://auth.openai.com/oauth/authorize`
- **Token URL**: `https://auth.openai.com/oauth/token`
- **Callback Port**: `1455`

## Features

- **PKCE**: Secure code exchange with SHA256 challenge
- **Auto-Refresh**: Tokens refresh automatically before expiry
- **Account Selection**: Uses `prompt=login` so you can choose the personal account that replaces the local account
- **Headless Support**: Works on servers without browsers

## Managing Account

```bash
# Show account
codex-proxy account show

# Add account (browser)
codex-proxy account add

# Add account (headless)
codex-proxy account add --no-browser

# Clear account
codex-proxy account clear
```

## Troubleshooting

### "Port already in use"
The `--no-browser` mode works independently of the server, so you can replace the local account even while the proxy is running.

### "Invalid state" error
This happens if you use a code from an old session. Generate a fresh URL and try again.

### Same account keeps getting selected
Clear cookies at `auth.openai.com` or use a private/incognito window.