refactor(litellm): derive Codex OAuth client from token

litellm/codex_provider.py

@@ -26,7 +26,6 @@ if "codex" not in litellm.provider_list:
 if "codex" not in litellm._custom_providers:
     litellm._custom_providers.append("codex")
 TOKEN_URL = "https://auth.openai.com/oauth/token"
-CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
 API_URL = "https://chatgpt.com/backend-api/codex/responses"
 
 
@@ -53,11 +52,39 @@ def _jwt_exp(token: str) -> int:
         return 0
 
 
+def _client_id(auth: dict) -> str:
+    """Resolve the OAuth client from config or the ID token audience."""
+    override = os.environ.get("CODEX_CLIENT_ID")
+    if override:
+        return override
+
+    try:
+        payload = auth["tokens"]["id_token"].split(".")[1]
+        payload += "=" * (-len(payload) % 4)
+        audience = json.loads(base64.urlsafe_b64decode(payload))["aud"]
+        if isinstance(audience, str) and audience:
+            return audience
+        if (
+            isinstance(audience, list)
+            and len(audience) == 1
+            and isinstance(audience[0], str)
+            and audience[0]
+        ):
+            return audience[0]
+    except (KeyError, IndexError, TypeError, ValueError, json.JSONDecodeError):
+        pass
+
+    raise ValueError(
+        "Codex OAuth client ID is unavailable: set CODEX_CLIENT_ID or "
+        "provide an id_token with a single aud value"
+    )
+
+
 def _refresh(auth: dict) -> dict:
     resp = httpx.post(
         TOKEN_URL,
         json={
-            "client_id": CLIENT_ID,
+            "client_id": _client_id(auth),
             "grant_type": "refresh_token",
             "refresh_token": auth["tokens"]["refresh_token"],
         },