Introduction

When using the Codex model in DeepSeek Harness, a specific issue arises: how to integrate the openai-codex model routing without wanting to put full OAuth credentials into plain text files. dsh-codex-keychain is an unofficial, standalone DSH plugin designed to handle this scenario: it adds the openai-codex model routing to DSH and keeps full OAuth credentials in the operating system’s native credential storage.

What is this

dsh-codex-keychain is maintained by CpfPatrick and is licensed under MIT. Currently, 0.1.0-alpha.1 is a developer preview, targeting DeepSeek Harness 0.1.0-rc.6 and @earendil-works/pi-ai 0.82.1.

It does not use the OpenAI Platform API key, nor does it use a fallback plaintext credential file, nor does it reuse ~/.codex/auth.json. This package only connects to the Codex backend that is open to eligible ChatGPT accounts, and has no affiliation or endorsement with OpenAI or DeepSeek.

Core Features

Below are the verified capabilities:

  • Adds openai-codex model routing.
  • Saves full OAuth credentials in the operating system’s native credential storage:
  • macOS Keychain
  • Windows Credential Manager
  • Linux Secret Service
  • Supports browser ChatGPT OAuth and device-code ChatGPT OAuth.
  • Supports automatic locked token refresh.
  • Provides Codex model catalog and DSH model-picker integration.
  • Supports DSH-native streaming, reasoning, tool calls, replay, and existing DSH image attachments/model vision.
  • Provides a dedicated Web settings page and headless CLI.
  • status --json only contains sign-in state, provider, platform, backend; on failure it contains a stable code and a safe message, but does not contain tokens, account IDs, or token timestamps.

Installation and Activation

First, install it to the specified DSH profile:

dsh plugin --profile web add dsh-codex-keychain@next

Start the Web client:

dsh web

Then, complete the login in the Web settings:

  1. Open Settings → OpenAI Codex.
  2. Select Sign in with browser.
  3. Click Open authorization page and complete the OpenAI authorization.
  4. After logging in, select the openai-codex model in DSH’s model picker.

This plugin does not modify the default model; you need to manually select the corresponding model.

Typical Usage

When the browser is unavailable, a headless host is required, or localhost callbacks cannot be bound, you can use CLI to login:

dsh plugin --profile web exec dsh-codex-keychain login
dsh plugin --profile web exec dsh-codex-keychain login --device-code

Check status:

dsh plugin --profile web exec dsh-codex-keychain status
dsh plugin --profile web exec dsh-codex-keychain status --json

Logout:

dsh plugin --profile web exec dsh-codex-keychain logout

If you need to remove native credentials before uninstalling, you can first execute logout and then remove the plugin:

dsh plugin --profile web exec dsh-codex-keychain logout
dsh plugin --profile web remove dsh-codex-keychain

Security and Boundaries

The boundaries of this plugin are quite clear:

  • It targets ChatGPT OAuth, not the OpenAI Platform API key. ChatGPT subscription access and OpenAI Platform API access are different products.
  • It only connects to the Codex backend open to eligible ChatGPT accounts.
  • If native credential storage is missing, locked, or unavailable, the plugin will report KEYCHAIN_UNAVAILABLE and refuse login without a plain file fallback.
  • Web authentication RPC is loopback-only; remote browsers cannot invoke authentication RPC.
  • OAuth URLs and device codes are transient; the plugin will not write them to application logs or persistent storage.
  • Browser callbacks use localhost port 1455.
  • Failed or incomplete refreshes will not replace previously saved credentials.
  • It does not include quota displays, web search, standalone image-viewing UI, or image generation.

Known alpha limitation: Currently, requests cannot be cancelled due to network stalls causing token refresh.

Use Cases and Notes

Suitable for the following situations:

  • Want to use the openai-codex model routing in DSH.
  • Want to log in via ChatGPT OAuth instead of OpenAI Platform API key.
  • Want credentials stored in the operating system’s native credential storage instead of plaintext files.
  • Require Web settings page or headless CLI login.

Usage Notes:

  • Currently, alpha is fixed for DSH 0.1.0-rc.6; pay attention to compatibility before upgrading DSH.
  • Runtime requirements are Node.js ^22.19 || >=24 and pnpm 11.7.0.
  • The plugin runs with the current dsh process permissions; you should check the source code, license, and dependencies before installing.
  • When logging in via CLI, OAuth URLs or device codes may be displayed; such output is temporary credential information and should not be shared or spread via screenshots.

Links

GitHub: https://github.com/CpfPatrick/dsh-codex-keychain