Add auth env observability

codex-rs/core/src/auth.rs

@@ -1246,6 +1246,10 @@ impl AuthManager {
             .is_some_and(CodexAuth::is_external_chatgpt_tokens)
     }
 
+    pub fn codex_api_key_env_enabled(&self) -> bool {
+        self.enable_codex_api_key_env
+    }
+
     /// Convenience constructor returning an `Arc` wrapper.
     pub fn shared(
         codex_home: PathBuf,

codex-rs/core/src/auth_env_telemetry.rs

@@ -0,0 +1,85 @@
+use codex_otel::AuthEnvTelemetryMetadata;
+
+use crate::auth::CODEX_API_KEY_ENV_VAR;
+use crate::auth::OPENAI_API_KEY_ENV_VAR;
+use crate::auth::REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR;
+use crate::model_provider_info::ModelProviderInfo;
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(crate) struct AuthEnvTelemetry {
+    pub(crate) openai_api_key_env_present: bool,
+    pub(crate) codex_api_key_env_present: bool,
+    pub(crate) codex_api_key_env_enabled: bool,
+    pub(crate) provider_env_key_name: Option<String>,
+    pub(crate) provider_env_key_present: Option<bool>,
+    pub(crate) refresh_token_url_override_present: bool,
+}
+
+impl AuthEnvTelemetry {
+    pub(crate) fn to_otel_metadata(&self) -> AuthEnvTelemetryMetadata {
+        AuthEnvTelemetryMetadata {
+            openai_api_key_env_present: self.openai_api_key_env_present,
+            codex_api_key_env_present: self.codex_api_key_env_present,
+            codex_api_key_env_enabled: self.codex_api_key_env_enabled,
+            provider_env_key_name: self.provider_env_key_name.clone(),
+            provider_env_key_present: self.provider_env_key_present,
+            refresh_token_url_override_present: self.refresh_token_url_override_present,
+        }
+    }
+}
+
+pub(crate) fn collect_auth_env_telemetry(
+    provider: &ModelProviderInfo,
+    codex_api_key_env_enabled: bool,
+) -> AuthEnvTelemetry {
+    AuthEnvTelemetry {
+        openai_api_key_env_present: env_var_present(OPENAI_API_KEY_ENV_VAR),
+        codex_api_key_env_present: env_var_present(CODEX_API_KEY_ENV_VAR),
+        codex_api_key_env_enabled,
+        // Custom provider `env_key` is arbitrary config text, so emit only a safe bucket.
+        provider_env_key_name: provider.env_key.as_ref().map(|_| "configured".to_string()),
+        provider_env_key_present: provider.env_key.as_deref().map(env_var_present),
+        refresh_token_url_override_present: env_var_present(REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR),
+    }
+}
+
+fn env_var_present(name: &str) -> bool {
+    match std::env::var(name) {
+        Ok(value) => !value.trim().is_empty(),
+        Err(std::env::VarError::NotUnicode(_)) => true,
+        Err(std::env::VarError::NotPresent) => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn collect_auth_env_telemetry_buckets_provider_env_key_name() {
+        let provider = ModelProviderInfo {
+            name: "Custom".to_string(),
+            base_url: None,
+            env_key: Some("sk-should-not-leak".to_string()),
+            env_key_instructions: None,
+            experimental_bearer_token: None,
+            wire_api: crate::model_provider_info::WireApi::Responses,
+            query_params: None,
+            http_headers: None,
+            env_http_headers: None,
+            request_max_retries: None,
+            stream_max_retries: None,
+            stream_idle_timeout_ms: None,
+            requires_openai_auth: false,
+            supports_websockets: false,
+        };
+
+        let telemetry = collect_auth_env_telemetry(&provider, false);
+
+        assert_eq!(
+            telemetry.provider_env_key_name,
+            Some("configured".to_string())
+        );
+    }
+}

codex-rs/core/src/client.rs

@@ -34,6 +34,8 @@ use crate::api_bridge::CoreAuthProvider;
 use crate::api_bridge::auth_provider_from_auth;
 use crate::api_bridge::map_api_error;
 use crate::auth::UnauthorizedRecovery;
+use crate::auth_env_telemetry::AuthEnvTelemetry;
+use crate::auth_env_telemetry::collect_auth_env_telemetry;
 use codex_api::CompactClient as ApiCompactClient;
 use codex_api::CompactionInput as ApiCompactionInput;
 use codex_api::MemoriesClient as ApiMemoriesClient;
@@ -106,7 +108,7 @@ use crate::response_debug_context::telemetry_transport_error_message;
 use crate::tools::spec::create_tools_json_for_responses_api;
 use crate::util::FeedbackRequestTags;
 use crate::util::emit_feedback_auth_recovery_tags;
-use crate::util::emit_feedback_request_tags;
+use crate::util::emit_feedback_request_tags_with_auth_env;
 
 pub const OPENAI_BETA_HEADER: &str = "OpenAI-Beta";
 pub const X_CODEX_TURN_STATE_HEADER: &str = "x-codex-turn-state";
@@ -135,6 +137,7 @@ struct ModelClientState {
     auth_manager: Option<Arc<AuthManager>>,
     conversation_id: ThreadId,
     provider: ModelProviderInfo,
+    auth_env_telemetry: AuthEnvTelemetry,
     session_source: SessionSource,
     model_verbosity: Option<VerbosityConfig>,
     responses_websockets_enabled_by_feature: bool,
@@ -264,11 +267,16 @@ impl ModelClient {
         include_timing_metrics: bool,
         beta_features_header: Option<String>,
     ) -> Self {
+        let codex_api_key_env_enabled = auth_manager
+            .as_ref()
+            .is_some_and(|manager| manager.codex_api_key_env_enabled());
+        let auth_env_telemetry = collect_auth_env_telemetry(&provider, codex_api_key_env_enabled);
         Self {
             state: Arc::new(ModelClientState {
                 auth_manager,
                 conversation_id,
                 provider,
+                auth_env_telemetry,
                 session_source,
                 model_verbosity,
                 responses_websockets_enabled_by_feature,
@@ -338,6 +346,7 @@ impl ModelClient {
                 PendingUnauthorizedRetry::default(),
             ),
             RequestRouteTelemetry::for_endpoint(RESPONSES_COMPACT_ENDPOINT),
+            self.state.auth_env_telemetry.clone(),
         );
         let client =
             ApiCompactClient::new(transport, client_setup.api_provider, client_setup.api_auth)
@@ -406,6 +415,7 @@ impl ModelClient {
                 PendingUnauthorizedRetry::default(),
             ),
             RequestRouteTelemetry::for_endpoint(MEMORIES_SUMMARIZE_ENDPOINT),
+            self.state.auth_env_telemetry.clone(),
         );
         let client =
             ApiMemoriesClient::new(transport, client_setup.api_provider, client_setup.api_auth)
@@ -450,11 +460,13 @@ impl ModelClient {
         session_telemetry: &SessionTelemetry,
         auth_context: AuthRequestTelemetryContext,
         request_route_telemetry: RequestRouteTelemetry,
+        auth_env_telemetry: AuthEnvTelemetry,
     ) -> Arc<dyn RequestTelemetry> {
         let telemetry = Arc::new(ApiTelemetry::new(
             session_telemetry.clone(),
             auth_context,
             request_route_telemetry,
+            auth_env_telemetry,
         ));
         let request_telemetry: Arc<dyn RequestTelemetry> = telemetry;
         request_telemetry
@@ -537,6 +549,7 @@ impl ModelClient {
             session_telemetry,
             auth_context,
             request_route_telemetry,
+            self.state.auth_env_telemetry.clone(),
         );
         let start = Instant::now();
         let result = ApiWebSocketResponsesClient::new(api_provider, api_auth)
@@ -570,27 +583,30 @@ impl ModelClient {
             response_debug.auth_error.as_deref(),
             response_debug.auth_error_code.as_deref(),
         );
-        emit_feedback_request_tags(&FeedbackRequestTags {
-            endpoint: request_route_telemetry.endpoint,
-            auth_header_attached: auth_context.auth_header_attached,
-            auth_header_name: auth_context.auth_header_name,
-            auth_mode: auth_context.auth_mode,
-            auth_retry_after_unauthorized: Some(auth_context.retry_after_unauthorized),
-            auth_recovery_mode: auth_context.recovery_mode,
-            auth_recovery_phase: auth_context.recovery_phase,
-            auth_connection_reused: Some(false),
-            auth_request_id: response_debug.request_id.as_deref(),
-            auth_cf_ray: response_debug.cf_ray.as_deref(),
-            auth_error: response_debug.auth_error.as_deref(),
-            auth_error_code: response_debug.auth_error_code.as_deref(),
-            auth_recovery_followup_success: auth_context
-                .retry_after_unauthorized
-                .then_some(result.is_ok()),
-            auth_recovery_followup_status: auth_context
-                .retry_after_unauthorized
-                .then_some(status)
-                .flatten(),
-        });
+        emit_feedback_request_tags_with_auth_env(
+            &FeedbackRequestTags {
+                endpoint: request_route_telemetry.endpoint,
+                auth_header_attached: auth_context.auth_header_attached,
+                auth_header_name: auth_context.auth_header_name,
+                auth_mode: auth_context.auth_mode,
+                auth_retry_after_unauthorized: Some(auth_context.retry_after_unauthorized),
+                auth_recovery_mode: auth_context.recovery_mode,
+                auth_recovery_phase: auth_context.recovery_phase,
+                auth_connection_reused: Some(false),
+                auth_request_id: response_debug.request_id.as_deref(),
+                auth_cf_ray: response_debug.cf_ray.as_deref(),
+                auth_error: response_debug.auth_error.as_deref(),
+                auth_error_code: response_debug.auth_error_code.as_deref(),
+                auth_recovery_followup_success: auth_context
+                    .retry_after_unauthorized
+                    .then_some(result.is_ok()),
+                auth_recovery_followup_status: auth_context
+                    .retry_after_unauthorized
+                    .then_some(status)
+                    .flatten(),
+            },
+            &self.state.auth_env_telemetry,
+        );
         result
     }
 
@@ -986,6 +1002,7 @@ impl ModelClientSession {
                 session_telemetry,
                 request_auth_context,
                 RequestRouteTelemetry::for_endpoint(RESPONSES_ENDPOINT),
+                self.client.state.auth_env_telemetry.clone(),
             );
             let compression = self.responses_request_compression(client_setup.auth.as_ref());
             let options = self.build_responses_options(turn_metadata_header, compression);
@@ -1149,11 +1166,13 @@ impl ModelClientSession {
         session_telemetry: &SessionTelemetry,
         auth_context: AuthRequestTelemetryContext,
         request_route_telemetry: RequestRouteTelemetry,
+        auth_env_telemetry: AuthEnvTelemetry,
     ) -> (Arc<dyn RequestTelemetry>, Arc<dyn SseTelemetry>) {
         let telemetry = Arc::new(ApiTelemetry::new(
             session_telemetry.clone(),
             auth_context,
             request_route_telemetry,
+            auth_env_telemetry,
         ));
         let request_telemetry: Arc<dyn RequestTelemetry> = telemetry.clone();
         let sse_telemetry: Arc<dyn SseTelemetry> = telemetry;
@@ -1165,11 +1184,13 @@ impl ModelClientSession {
         session_telemetry: &SessionTelemetry,
         auth_context: AuthRequestTelemetryContext,
         request_route_telemetry: RequestRouteTelemetry,
+        auth_env_telemetry: AuthEnvTelemetry,
     ) -> Arc<dyn WebsocketTelemetry> {
         let telemetry = Arc::new(ApiTelemetry::new(
             session_telemetry.clone(),
             auth_context,
             request_route_telemetry,
+            auth_env_telemetry,
         ));
         let websocket_telemetry: Arc<dyn WebsocketTelemetry> = telemetry;
         websocket_telemetry
@@ -1633,18 +1654,21 @@ struct ApiTelemetry {
     session_telemetry: SessionTelemetry,
     auth_context: AuthRequestTelemetryContext,
     request_route_telemetry: RequestRouteTelemetry,
+    auth_env_telemetry: AuthEnvTelemetry,
 }
 
 impl ApiTelemetry {
     fn new(
         session_telemetry: SessionTelemetry,
         auth_context: AuthRequestTelemetryContext,
         request_route_telemetry: RequestRouteTelemetry,
+        auth_env_telemetry: AuthEnvTelemetry,
     ) -> Self {
         Self {
             session_telemetry,
             auth_context,
             request_route_telemetry,
+            auth_env_telemetry,
         }
     }
 }
@@ -1678,29 +1702,32 @@ impl RequestTelemetry for ApiTelemetry {
             debug.auth_error.as_deref(),
             debug.auth_error_code.as_deref(),
         );
-        emit_feedback_request_tags(&FeedbackRequestTags {
-            endpoint: self.request_route_telemetry.endpoint,
-            auth_header_attached: self.auth_context.auth_header_attached,
-            auth_header_name: self.auth_context.auth_header_name,
-            auth_mode: self.auth_context.auth_mode,
-            auth_retry_after_unauthorized: Some(self.auth_context.retry_after_unauthorized),
-            auth_recovery_mode: self.auth_context.recovery_mode,
-            auth_recovery_phase: self.auth_context.recovery_phase,
-            auth_connection_reused: None,
-            auth_request_id: debug.request_id.as_deref(),
-            auth_cf_ray: debug.cf_ray.as_deref(),
-            auth_error: debug.auth_error.as_deref(),
-            auth_error_code: debug.auth_error_code.as_deref(),
-            auth_recovery_followup_success: self
-                .auth_context
-                .retry_after_unauthorized
-                .then_some(error.is_none()),
-            auth_recovery_followup_status: self
-                .auth_context
-                .retry_after_unauthorized
-                .then_some(status)
-                .flatten(),
-        });
+        emit_feedback_request_tags_with_auth_env(
+            &FeedbackRequestTags {
+                endpoint: self.request_route_telemetry.endpoint,
+                auth_header_attached: self.auth_context.auth_header_attached,
+                auth_header_name: self.auth_context.auth_header_name,
+                auth_mode: self.auth_context.auth_mode,
+                auth_retry_after_unauthorized: Some(self.auth_context.retry_after_unauthorized),
+                auth_recovery_mode: self.auth_context.recovery_mode,
+                auth_recovery_phase: self.auth_context.recovery_phase,
+                auth_connection_reused: None,
+                auth_request_id: debug.request_id.as_deref(),
+                auth_cf_ray: debug.cf_ray.as_deref(),
+                auth_error: debug.auth_error.as_deref(),
+                auth_error_code: debug.auth_error_code.as_deref(),
+                auth_recovery_followup_success: self
+                    .auth_context
+                    .retry_after_unauthorized
+                    .then_some(error.is_none()),
+                auth_recovery_followup_status: self
+                    .auth_context
+                    .retry_after_unauthorized
+                    .then_some(status)
+                    .flatten(),
+            },
+            &self.auth_env_telemetry,
+        );
     }
 }
 
@@ -1729,29 +1756,32 @@ impl WebsocketTelemetry for ApiTelemetry {
             error_message.as_deref(),
             connection_reused,
         );
-        emit_feedback_request_tags(&FeedbackRequestTags {
-            endpoint: self.request_route_telemetry.endpoint,
-            auth_header_attached: self.auth_context.auth_header_attached,
-            auth_header_name: self.auth_context.auth_header_name,
-            auth_mode: self.auth_context.auth_mode,
-            auth_retry_after_unauthorized: Some(self.auth_context.retry_after_unauthorized),
-            auth_recovery_mode: self.auth_context.recovery_mode,
-            auth_recovery_phase: self.auth_context.recovery_phase,
-            auth_connection_reused: Some(connection_reused),
-            auth_request_id: debug.request_id.as_deref(),
-            auth_cf_ray: debug.cf_ray.as_deref(),
-            auth_error: debug.auth_error.as_deref(),
-            auth_error_code: debug.auth_error_code.as_deref(),
-            auth_recovery_followup_success: self
-                .auth_context
-                .retry_after_unauthorized
-                .then_some(error.is_none()),
-            auth_recovery_followup_status: self
-                .auth_context
-                .retry_after_unauthorized
-                .then_some(status)
-                .flatten(),
-        });
+        emit_feedback_request_tags_with_auth_env(
+            &FeedbackRequestTags {
+                endpoint: self.request_route_telemetry.endpoint,
+                auth_header_attached: self.auth_context.auth_header_attached,
+                auth_header_name: self.auth_context.auth_header_name,
+                auth_mode: self.auth_context.auth_mode,
+                auth_retry_after_unauthorized: Some(self.auth_context.retry_after_unauthorized),
+                auth_recovery_mode: self.auth_context.recovery_mode,
+                auth_recovery_phase: self.auth_context.recovery_phase,
+                auth_connection_reused: Some(connection_reused),
+                auth_request_id: debug.request_id.as_deref(),
+                auth_cf_ray: debug.cf_ray.as_deref(),
+                auth_error: debug.auth_error.as_deref(),
+                auth_error_code: debug.auth_error_code.as_deref(),
+                auth_recovery_followup_success: self
+                    .auth_context
+                    .retry_after_unauthorized
+                    .then_some(error.is_none()),
+                auth_recovery_followup_status: self
+                    .auth_context
+                    .retry_after_unauthorized
+                    .then_some(status)
+                    .flatten(),
+            },
+            &self.auth_env_telemetry,
+        );
     }
 
     fn on_ws_event(