Skip to content

fix(openai): correct Realtime auth and transcription secrets#102518

Merged
steipete merged 2 commits into
mainfrom
codex/fix-openai-realtime-auth-transcription
Jul 9, 2026
Merged

fix(openai): correct Realtime auth and transcription secrets#102518
steipete merged 2 commits into
mainfrom
codex/fix-openai-realtime-auth-transcription

Conversation

@steipete

@steipete steipete commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

OpenAI Realtime voice and streaming transcription treated Codex OAuth tokens as interchangeable with OpenAI Platform API keys and sent them to public Platform endpoints. The transcription path also called the retired /v1/realtime/transcription_sessions endpoint, so valid credentials still received a 404.

Why This Change Was Made

  • Require Platform API-key sources for both OpenAI Realtime surfaces.
  • Stop discovering or advertising Codex OAuth as Realtime auth.
  • Mint transcription secrets through /v1/realtime/client_secrets with the current { session: ... } request shape.
  • Prefer a configured API-key profile over OPENAI_API_KEY, matching the Talk path and preventing a stale environment key from shadowing the profile.
  • Bound 401 errors so provider responses cannot echo credential material into the UI.
  • Align provider and Control UI documentation with the actual authentication contract. Release-note context stays here because current repository policy makes CHANGELOG.md release-owned.

Direct inspection of the Codex client confirms ChatGPT auth uses the ChatGPT backend and account routing, while API-key Realtime conversations use the public Platform endpoint. This is therefore an auth-owner boundary fix, not a SecretRef transport workaround.

User Impact

Control UI Talk and Voice Call Realtime no longer attempt a doomed OAuth fallback. Users get an actionable Platform API-key requirement instead. Streaming transcription works again with the current OpenAI client-secret API. Existing SecretRef-backed Platform keys continue to resolve only at the network boundary.

Evidence

  • Blacksmith Testbox: 80 passed across the three focused OpenAI Realtime suites.
  • Blacksmith Testbox: pnpm check:changed passed.
  • Independent autoreview: no actionable findings; patch rated correct at 0.87 confidence.
  • Live OpenAI API with a 1Password-backed Platform key:
    • old transcription endpoint: HTTP 404
    • current transcription client-secret request: HTTP 200 with an ephemeral secret
    • current Realtime browser client-secret request: HTTP 200 with an ephemeral secret
  • Live clawmac Gateway with a file SecretRef: talk.client.create returned the OpenAI WebRTC transport and current Realtime calls offer URL without exposing the Platform key.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: openai size: M maintainer Maintainer-authored PR labels Jul 9, 2026
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Land-ready proof for exact head 37d843c3201f721c87d55ae338b999a52b474684:

  • pnpm test extensions/openai/realtime-provider-shared.test.ts extensions/openai/realtime-transcription-provider.test.ts extensions/openai/realtime-voice-provider.test.ts — 3 files, 80 tests passed on Blacksmith Testbox tbx_01kx2waz9vqw38298ch842xv4p.
  • pnpm check:changed — passed on the same Testbox and exact head.
  • Fresh Codex autoreview — no accepted/actionable findings; patch rated correct with 0.87 confidence.
  • Live Platform API proof with the saved OpenAI key: Realtime browser and transcription client-secret requests returned HTTP 200; the retired transcription endpoint returned HTTP 404.
  • Live Gateway SecretRef proof: talk.client.create selected OpenAI WebRTC and returned an ephemeral secret plus https://api.openai.com/v1/realtime/calls; no Platform key crossed into the browser.

Known proof gap: the installed pre-fix Mac app discards the provider response body when the browser-owned SDP offer fails, so that UI leg reports only a generic connection reset. A signed exact-head app build and post-merge Gateway install are being used for the final end-to-end retry; the provider/auth and client-secret boundaries are covered above.

@clawsweeper

clawsweeper Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: stale review; fresh review needed.

Summary
The latest durable ClawSweeper review was for head 37d843c3201f721c87d55ae338b999a52b474684, but the PR head is now 7b1b9268c1114a4c2dae775502566fccaba000cb. Its old verdict and PR readiness labels are no longer current.

Next step
Run or wait for a fresh ClawSweeper review on the current PR head.

@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Final exact-head proof for 7b1b9268c1114a4c2dae775502566fccaba000cb:

  • Blacksmith Testbox tbx_01kx2waz9vqw38298ch842xv4p: 3 focused OpenAI Realtime files, 80 tests passed.
  • Same exact head: pnpm check:changed passed.
  • Developer-ID-signed /Applications/OpenClaw.app build 2026.6.11 embeds OpenClawGitCommit=7b1b9268c11 and passes strict deep code-sign verification.
  • Mac Control UI WebRTC: Talk reached Listening... with the 1Password-backed OpenAI key retained as a file SecretRef.
  • Mac Control UI forced Gateway relay: Talk reached Listening...; Gateway logs recorded session.ready, transcript.done, output.text.done, and output.audio.done for provider openai and transport gateway-relay.
  • Restored talk.realtime.transport to the default after the relay proof.

The prior UI proof gap is closed. Remaining audit follow-ups are diagnostics-only: preserve the SDP response body on WebRTC failure, and surface a failed relay-creation error instead of rethrowing the original client-session error.

@steipete
steipete merged commit 9566ade into main Jul 9, 2026
97 checks passed
@steipete
steipete deleted the codex/fix-openai-realtime-auth-transcription branch July 9, 2026 07:55
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

@clawsweeper clawsweeper Bot mentioned this pull request Jul 9, 2026
Merged
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 10, 2026
@steipete
fix(openai): correct Realtime auth and transcription secrets (opencla…
db4bd15 
…w#102518)

* fix(openai): correct Realtime auth and transcription secrets

* chore: leave release notes to release automation
wheakerd pushed a commit to wheakerd/clawdbot that referenced this pull request Jul 15, 2026
@steipete @RomneyDa
fix(openai): correct Realtime auth and transcription secrets (opencla…
fb98875 
…w#102518)

* fix(openai): correct Realtime auth and transcription secrets

* chore: leave release notes to release automation

(cherry picked from commit 9566ade)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

docs Improvements or additions to documentation extensions: openai maintainer Maintainer-authored PR size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete