fix(telemetry): treat API-key Codex auth as a supported install

[yordis]

• Authenticating Codex with an API key is a supported configuration, but it produced a warning with a full stack trace on every server start, so a healthy install read as a broken one in the logs.
• The warning exists to surface unreadable or corrupt identity files. Firing it on a valid file trains us to ignore the one signal that should mean something.

[cursor]

PR Summary

Low Risk
Narrow change to telemetry identity file parsing and logging; no changes to authentication or sensitive data handling beyond avoiding log noise.

Overview
Codex API-key installs no longer trigger telemetry decode warnings on every server start. ~/.codex/auth.json without a tokens block (normal for API-key auth) is treated like a missing identity source: resolution falls through to Claude, then the anonymous ID, without TelemetryIdentityDecodeError logs or stack traces.

The Codex auth schema now makes tokens optional; only unreadable or truly malformed files still warn. A new test locks in quiet fallback and asserts the API key never appears in captured logs.

Fork docs add ledger entry 0007 for this upstream-bound fix.

^{Reviewed by Cursor Bugbot for commit 16003ce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

@yordis, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 42 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 64a2eb33-d126-411f-98b5-7580b09663a4

📥 Commits

Reviewing files that changed from the base of the PR and between 15ad1a0 and 16003ce.

📒 Files selected for processing (2)

• docs/fork/0007-codex-api-key-auth-is-supported.md
• docs/fork/README.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 39f69289-a0cc-45f0-95eb-90c05da858b4

📥 Commits

Reviewing files that changed from the base of the PR and between 3f9510b and 15ad1a0.

📒 Files selected for processing (2)

• apps/server/src/telemetry/Identify.test.ts
• apps/server/src/telemetry/Identify.ts

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

Walkthrough

Codex authentication parsing now supports API-key-only files. These files quietly fall through to the persisted anonymous ID. An integration test verifies identity selection, logging behavior, and API-key redaction.

Changes

Codex identity handling

Layer / File(s)	Summary
API-key-only identity fallback apps/server/src/telemetry/Identify.ts, apps/server/src/telemetry/Identify.test.ts	The Codex schema accepts missing tokens. Identity lookup returns no Codex identity when tokens are absent. Documentation distinguishes quiet fallthrough from warning cases. The integration test verifies anonymous ID fallback and API-key exclusion from logs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 15ad1

This change stops valid API-key authentication from generating misleading startup warnings while preserving the warning for unreadable or corrupt identity files; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: juliusmarminge

Poem

I’m a rabbit with keys tucked away,
No secret leaks in the logs today.
Tokens absent? The path falls through,
Anonymous IDs carry it through.
Hop, hop—telemetry stays true!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the problem and rationale but omits the required section headings and checklist.	Add What Changed, Why, and Checklist sections, and state that UI changes are not applicable or remove that section.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: supporting Codex API-key authentication in telemetry.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/fix-codex-telemetry-api-key-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}