vxcontrol/pentagi
1
0
Fork 0
mirror of https://github.com/vxcontrol/pentagi.git synced 2026-07-21 08:15:23 -04:00
Code Issues 45 Packages Projects Releases 9 Wiki Activity

[GH-ISSUE #311] [Enhancement]: Add ChatGPT Plus/Pro authentication as an alternative to OpenAI API key #97

New Issue
Closed
opened 2026-06-06 22:09:07 -04:00 by yindo · 1 comment
yindo commented 2026-06-06 22:09:07 -04:00
Owner
Copy Link
Copy Source

Originally created by @rwxce on GitHub (May 13, 2026).
Original GitHub issue: https://github.com/vxcontrol/pentagi/issues/311

Originally assigned to: @asdek on GitHub.

Target Component

Core Services (Frontend UI/Backend API)

Enhancement Description

Problem Statement:

  • Current Limitation:
    PentAGI currently supports OpenAI connection through an API key only.

  • Use Case:
    I run PentAGI in a self-hosted environment and would like to connect OpenAI using my ChatGPT Plus/Pro account, not only through an API key.

    A similar authentication model exists in tools such as OpenCode, where users can authenticate with their ChatGPT account (headless) instead of relying only on an OpenAI API key.

Proposed Solution:

  • Feature Description:
    Add support for ChatGPT Plus/Pro authentication as an additional OpenAI connection method.

    Suggested login methods:

    • ChatGPT Plus/Pro login through browser
    • ChatGPT Plus/Pro login through headless
    • Existing API key authentication remains available

    The browser flow would be useful for local deployments.
    The headless flow would be useful for Docker, VPS, CI, homelab, and SSH-only environments.

  • Expected Benefits:

    • Allows users with ChatGPT Plus/Pro subscriptions to authenticate without requiring a separate OpenAI API key
    • Improves deployment flexibility for self-hosted PentAGI instances
    • Better user experience for Docker and remote server environments
    • Reduces costs for users already authenticated with ChatGPT
    • Provides parity with modern AI development tools that support account-based authentication

Technical Details

Implementation Approach:

  • Architecture Changes:
    Add an OpenAI authentication abstraction that supports multiple authentication methods:

    1. API key
    2. ChatGPT Plus/Pro browser login
    3. ChatGPT Plus/Pro headless/device-code login

    The selected authentication method should be stored in the existing configuration system and used transparently by PentAGI agents.

  • New Components:

    • OpenAI auth provider selector
    • Browser-based ChatGPT login flow
    • Headless/device-code login flow
    • Secure token/session storage
    • Token refresh handling
    • Connection status indicator in the UI
    • Re-authenticate/disconnect action

  • Dependencies:
    If possible, use a standards-based OAuth/device-code flow or the same authentication approach used by comparable tools such as OpenCode/Codex-style clients.

Integration Points:

  • AI Agents:
    Agents should use the configured OpenAI authentication method transparently.

  • Memory System:
    No direct changes expected.

  • Monitoring:
    Add logs or status events for:

    • Authentication method selected
    • Login started
    • Login completed
    • Token/session expired
    • Token refresh failed
    • Re-authentication required

Security Considerations:

  • Tokens and sessions must be stored securely.
  • Tokens must never be printed in logs.
  • Headless login codes should expire after a short time.
  • The feature should respect OpenAI account limitations and terms of service.
  • This should be designed for authorized personal/workspace authentication, not credential sharing or resale.

Designs and Mockups

Suggested UI:

OpenAI Connection Method:

  • API key
  • ChatGPT Plus/Pro via browser
  • ChatGPT Plus/Pro headless

Suggested headless flow:

sequenceDiagram
    User->>PentAGI: Select ChatGPT Plus/Pro headless login
    PentAGI->>OpenAI/Auth: Request login/device code
    OpenAI/Auth-->>PentAGI: Return verification URL and code
    PentAGI-->>User: Display URL and one-time code
    User->>Browser: Open URL and authenticate
    OpenAI/Auth-->>PentAGI: Authentication completed
    PentAGI->>PentAGI: Store session/token securely
    Agent->>PentAGI: Request OpenAI model call
    PentAGI->>OpenAI: Use authenticated session
    OpenAI-->>PentAGI: Return response

Alternative Solutions

Alternative Approaches:

  1. Keep API key only

    • Pros: Simple and already implemented
    • Cons: Requires separate API setup and billing, even for users who already have ChatGPT Plus/Pro

  2. Manual token import

    • Pros: Faster to implement
    • Cons: Fragile, insecure, and bad user experience

Reason for Preferred Solution:

Supporting both browser and headless ChatGPT Plus/Pro authentication would make PentAGI more flexible for local and self-hosted deployments while keeping API key authentication available for users who prefer the current setup.

Verification

  • I have checked that this enhancement hasn't been already proposed
  • This enhancement aligns with PentAGI's goal of autonomous penetration testing
  • I have considered the security implications of this enhancement
  • I have provided clear use cases and benefits
Originally created by @rwxce on GitHub (May 13, 2026). Original GitHub issue: https://github.com/vxcontrol/pentagi/issues/311 Originally assigned to: @asdek on GitHub. ### Target Component Core Services (Frontend UI/Backend API) ### Enhancement Description Problem Statement: - Current Limitation: PentAGI currently supports OpenAI connection through an API key only. - Use Case: I run PentAGI in a self-hosted environment and would like to connect OpenAI using my ChatGPT Plus/Pro account, not only through an API key. A similar authentication model exists in tools such as OpenCode, where users can authenticate with their ChatGPT account (headless) instead of relying only on an OpenAI API key. Proposed Solution: - Feature Description: Add support for ChatGPT Plus/Pro authentication as an additional OpenAI connection method. Suggested login methods: - ChatGPT Plus/Pro login through browser - ChatGPT Plus/Pro login through headless - Existing API key authentication remains available The browser flow would be useful for local deployments. The headless flow would be useful for Docker, VPS, CI, homelab, and SSH-only environments. - Expected Benefits: - Allows users with ChatGPT Plus/Pro subscriptions to authenticate without requiring a separate OpenAI API key - Improves deployment flexibility for self-hosted PentAGI instances - Better user experience for Docker and remote server environments - Reduces costs for users already authenticated with ChatGPT - Provides parity with modern AI development tools that support account-based authentication ### Technical Details Implementation Approach: - Architecture Changes: Add an OpenAI authentication abstraction that supports multiple authentication methods: 1. API key 2. ChatGPT Plus/Pro browser login 3. ChatGPT Plus/Pro headless/device-code login The selected authentication method should be stored in the existing configuration system and used transparently by PentAGI agents. - New Components: - OpenAI auth provider selector - Browser-based ChatGPT login flow - Headless/device-code login flow - Secure token/session storage - Token refresh handling - Connection status indicator in the UI - Re-authenticate/disconnect action - Dependencies: If possible, use a standards-based OAuth/device-code flow or the same authentication approach used by comparable tools such as OpenCode/Codex-style clients. Integration Points: - AI Agents: Agents should use the configured OpenAI authentication method transparently. - Memory System: No direct changes expected. - Monitoring: Add logs or status events for: - Authentication method selected - Login started - Login completed - Token/session expired - Token refresh failed - Re-authentication required Security Considerations: - Tokens and sessions must be stored securely. - Tokens must never be printed in logs. - Headless login codes should expire after a short time. - The feature should respect OpenAI account limitations and terms of service. - This should be designed for authorized personal/workspace authentication, not credential sharing or resale. ### Designs and Mockups Suggested UI: OpenAI Connection Method: - [ ] API key - [ ] ChatGPT Plus/Pro via browser - [ ] ChatGPT Plus/Pro headless Suggested headless flow: ```mermaid sequenceDiagram User->>PentAGI: Select ChatGPT Plus/Pro headless login PentAGI->>OpenAI/Auth: Request login/device code OpenAI/Auth-->>PentAGI: Return verification URL and code PentAGI-->>User: Display URL and one-time code User->>Browser: Open URL and authenticate OpenAI/Auth-->>PentAGI: Authentication completed PentAGI->>PentAGI: Store session/token securely Agent->>PentAGI: Request OpenAI model call PentAGI->>OpenAI: Use authenticated session OpenAI-->>PentAGI: Return response ``` ### Alternative Solutions Alternative Approaches: 1. Keep API key only - Pros: Simple and already implemented - Cons: Requires separate API setup and billing, even for users who already have ChatGPT Plus/Pro 2. Manual token import - Pros: Faster to implement - Cons: Fragile, insecure, and bad user experience Reason for Preferred Solution: Supporting both browser and headless ChatGPT Plus/Pro authentication would make PentAGI more flexible for local and self-hosted deployments while keeping API key authentication available for users who prefer the current setup. ### Verification - [x] I have checked that this enhancement hasn't been already proposed - [x] This enhancement aligns with PentAGI's goal of autonomous penetration testing - [x] I have considered the security implications of this enhancement - [x] I have provided clear use cases and benefits
yindo added the enhancement label 2026-06-06 22:09:07 -04:00
yindo closed this issue 2026-06-06 22:09:07 -04:00
yindo commented 2026-06-06 22:09:08 -04:00
Author
Owner
Copy Link
Copy Source

@sickwell commented on GitHub (May 15, 2026):

Hello, and thank you for the issue proposal.

Currently, PentAGI already supports OpenAI integration via API key, which is also the officially supported authentication method for the OpenAI API.

Supporting ChatGPT Plus/Pro session-based authentication would not be a small configuration change: it would require a separate authentication/client layer and likely significant changes or workarounds around langchain-go. We don’t plan to maintain that path, especially given PentAGI’s cybersecurity-related use cases and the additional approval requirements that may apply there.

<!-- gh-comment-id:4458959248 --> @sickwell commented on GitHub (May 15, 2026): Hello, and thank you for the issue proposal. Currently, PentAGI already supports OpenAI integration via API key, which is also the officially supported authentication method for the OpenAI API. Supporting ChatGPT Plus/Pro session-based authentication would not be a small configuration change: it would require a separate authentication/client layer and likely significant changes or workarounds around langchain-go. We don’t plan to maintain that path, especially given PentAGI’s cybersecurity-related use cases and the additional approval requirements that may apply there.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: vxcontrol/pentagi#97
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?