[feature] OAuth passthrough for OpenAI provider (Codex CLI subscription support)

core/bifrost.go

@@ -5547,6 +5547,25 @@ func (bifrost *Bifrost) requestWorker(provider schemas.Provider, config *schemas
 		// Tells the logging plugin whether to persist raw bytes in log records.
 		req.Context.SetValue(schemas.BifrostContextKeyShouldStoreRawInLogs, effectiveStore)
 
+		// ChatGPT OAuth: extract Bearer token from request headers and inject as direct key.
+		// This bypasses the need for allow_direct_keys — the provider's chatgpt_oauth flag
+		// is sufficient authorization to forward the caller's token. Logic lives in the
+		// openai package to keep all ChatGPT-specific code in one module.
+		if config.OpenAIConfig != nil && config.OpenAIConfig.ChatGPTOAuth {
+			if _, alreadySet := req.Context.Value(schemas.BifrostContextKeyDirectKey).(schemas.Key); !alreadySet {
+				if headers, ok := req.Context.Value(schemas.BifrostContextKeyRequestHeaders).(map[string]string); ok {
+					if token := openai.ExtractChatGPTOAuthBearerToken(headers); token != "" {
+						req.Context.SetValue(schemas.BifrostContextKeyDirectKey, schemas.Key{
+							ID:     openai.ChatGPTOAuthDirectKeyID,
+							Value:  *schemas.NewEnvVar(token),
+							Models: []string{},
+							Weight: 1.0,
+						})
+					}
+				}
+			}
+		}
+
 		var keys []schemas.Key
 		// keyProvider is passed to executeRequestWithRetries to manage key selection and rotation.
 		// It is nil when no key is required (e.g. providerRequiresKey=false) or for multi-key

core/providers/azure/azure.go

@@ -824,6 +824,7 @@ func (provider *AzureProvider) ResponsesStream(ctx *schemas.BifrostContext, post
 			nil,
 			nil,
 			nil,
+			nil,
 			provider.logger,
 			postHookSpanFinalizer,
 		)

core/providers/fireworks/fireworks.go

@@ -80,7 +80,6 @@ func (provider *FireworksProvider) ListModels(ctx *schemas.BifrostContext, keys
 	)
 }
 
-
 // TextCompletion performs a text completion request to the Fireworks AI API.
 func (provider *FireworksProvider) TextCompletion(ctx *schemas.BifrostContext, key schemas.Key, request *schemas.BifrostTextCompletionRequest) (*schemas.BifrostTextCompletionResponse, *schemas.BifrostError) {
 	return openai.HandleOpenAITextCompletionRequest(
@@ -188,6 +187,7 @@ func (provider *FireworksProvider) Responses(ctx *schemas.BifrostContext, key sc
 		nil,
 		nil,
 		provider.logger,
+		nil,
 	)
 }
 
@@ -212,6 +212,7 @@ func (provider *FireworksProvider) ResponsesStream(ctx *schemas.BifrostContext,
 		nil,
 		nil,
 		nil,
+		nil,
 		provider.logger,
 		postHookSpanFinalizer,
 	)