feat(OpenAI Chat Model Node): Add OpenAI account OAuth support

[EtienneLescot]

Summary

Add OpenAI account OAuth support to the OpenAI Chat Model node while keeping the existing API key credential path unchanged.

This adds a dedicated OpenAI Account (ChatGPT) credential and lets the OpenAI Chat Model node choose between API key and OAuth2 authentication. The OAuth2 credential stays aligned with n8n's existing credential UX: users still use the standard Connect button and popup/BroadcastChannel flow, while the popup hosts OpenAI's device-code login flow instead of asking users to paste an access token manually.

OpenAI account tokens cannot call the public OpenAI Responses API directly, so OAuth-backed chat model execution uses the ChatGPT/Codex account backend and maps LangChain messages, streaming chunks, tool calls, tool results, model discovery, and reasoning effort into that protocol. API key execution continues to use the existing OpenAI/LangChain path.

OpenAI-specific credential UI is kept small: the OAuth redirect URL and HTTP Request domain restriction controls are hidden for this credential because they do not apply to the device-code flow.

Related Linear tickets, Github issues, and Community forum posts

• Related to Add OpenAI OAuth credential support for OpenAI Chat Model nodes #29180
• Community forum: https://community.n8n.io/t/feature-oauth2-support-for-openai-chatgpt/285451
• Docs follow-up: Document OpenAI Account authentication for OpenAI Chat Model n8n-docs#4526
• Docs PR: docs: Document OpenAI account authentication n8n-docs#4527

No Linear ticket is linked because this is an external contribution and I do not have access to the n8n Linear workspace. The GitHub issue was auto-closed because n8n uses GitHub issues for bugs only, but it is kept here as public context for this contribution.

Review / Merge checklist

• I have seen this code, I have run this code, and I take responsibility for this code.
• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

Validation

• pushd packages/nodes-base && pnpm test OpenAiApi.credentials.test.ts --runInBand && popd
• pushd packages/@n8n/nodes-langchain && pnpm test LmChatOpenAi.test.ts OpenAiAccountChatModel.test.ts LMChatOpenAi/methods/__tests__/loadModels.test.ts --runInBand && popd
• pushd packages/cli && pnpm test openai-oauth2-device.controller.test.ts oauth2-credential.controller.test.ts load-nodes-and-credentials.test.ts --runInBand && popd
• pushd packages/frontend/editor-ui && pnpm vitest run src/features/credentials/components/CredentialEdit/CredentialEdit.test.ts src/features/credentials/components/CredentialEdit/CredentialConfig.test.ts && popd
• pushd packages/nodes-base && NODE_OPTIONS=--max-old-space-size=8192 pnpm lint && popd
• pushd packages/@n8n/nodes-langchain && pnpm lint && popd
• pushd packages/cli && NODE_OPTIONS=--max-old-space-size=8192 pnpm lint && popd
• pushd packages/frontend/editor-ui && pnpm lint && popd
• pushd packages/cli && NODE_OPTIONS=--max-old-space-size=8192 pnpm typecheck && popd
• pushd packages/@n8n/nodes-langchain && pnpm typecheck && popd
• pushd packages/nodes-base && pnpm typecheck && popd
• pushd packages/frontend/editor-ui && pnpm typecheck && popd
• pnpm build > build.log 2>&1
• git diff --check origin/master..HEAD
• Manual local startup and workflow test with OAuth credential on http://localhost:5680

[CLAassistant]

All committers have signed the CLA.

[n8n-assistant]

Hey @EtienneLescot,

Thank you for your contribution. We appreciate the time and effort you’ve taken to submit this pull request.

Before we can proceed, please ensure the following:
• Tests are included for any new functionality, logic changes or bug fixes.
• The PR aligns with our contribution guidelines.

Regarding new nodes:
We no longer accept new nodes directly into the core codebase. Instead, we encourage contributors to follow our Community Node Submission Guide to publish nodes independently.

If your node integrates with an AI service that you own or represent, please email nodes@n8n.io and we will be happy to discuss the best approach.

About review timelines:
This PR has been added to our internal tracker as "GHC-7924". While we plan to review it, we are currently unable to provide an exact timeframe. Our goal is to begin reviews within a month, but this may change depending on team priorities. We will reach out when the review begins.

Thank you again for contributing to n8n.

[n8n-assistant]

Hey @EtienneLescot,

Thank you for your contribution. We appreciate the time and effort you’ve taken to submit this pull request.

Before we can proceed, please ensure the following:
• Tests are included for any new functionality, logic changes or bug fixes.
• The PR aligns with our contribution guidelines.

Regarding new nodes:
We no longer accept new nodes directly into the core codebase. Instead, we encourage contributors to follow our Community Node Submission Guide to publish nodes independently.

If your node integrates with an AI service that you own or represent, please email nodes@n8n.io and we will be happy to discuss the best approach.

About review timelines:
This PR has been added to our internal tracker as "GHC-7925". While we plan to review it, we are currently unable to provide an exact timeframe. Our goal is to begin reviews within a month, but this may change depending on team priorities. We will reach out when the review begins.

Thank you again for contributing to n8n.

[EtienneLescot]

Addressed the Aikido secret-scan false positives by replacing fixture-looking test values with clearly synthetic test data generated at runtime. No real secrets were present.

[cubic-dev-ai]

7 issues found across 24 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/cli/src/controllers/oauth/openai-oauth2-device.controller.ts">

<violation number="1" location="packages/cli/src/controllers/oauth/openai-oauth2-device.controller.ts:77">
P2: Custom agent: **Use DTOs for Request Body Validation**

Controller endpoint reads `req.body` directly instead of using `@Body` with a `*Dto` class for standardized runtime validation.</violation>

<violation number="2" location="packages/cli/src/controllers/oauth/openai-oauth2-device.controller.ts:329">
P1: Custom agent: **Security Review**

Unescaped JSON is interpolated into an inline `<script>`, enabling script-breakout/XSS if interpolated values contain `</script>`-like payloads.</violation>
</file>

<file name="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/OpenAiAccountChatModel.ts">

<violation number="1" location="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/OpenAiAccountChatModel.ts:422">
P2: Streaming path never populates `assistantPhase`, so phase metadata is dropped in streamed responses while non-stream responses preserve it.</violation>

<violation number="2" location="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/OpenAiAccountChatModel.ts:473">
P2: Finish reason is inferred only from tool-call presence, so provider terminal reasons (e.g., incomplete due to max tokens/content filter) are lost and reported as stop/tool-calls.</violation>

<violation number="3" location="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/OpenAiAccountChatModel.ts:1092">
P2: SSE parsing is hardcoded to `\n\n` delimiters and is not compatible with valid CRLF-framed SSE streams.</violation>
</file>

<file name="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts">

<violation number="1" location="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts:65">
P2: OAuth model discovery uses raw fetch without proxy dispatcher, unlike the existing API-key path, which can break model loading behind required outbound proxies.</violation>
</file>

<file name="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/LmChatOpenAi.node.ts">

<violation number="1" location="packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/LmChatOpenAi.node.ts:805">
P2: OAuth2 execution path returns early and skips the node’s normal option mapping, so many user-configured model options are silently ignored for OpenAI Account auth.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant UI as n8n Editor UI
    participant Backend as n8n Backend (CLI)
    participant OAIAuth as OpenAI Auth API
    participant OAICodex as OpenAI Codex API (ChatGPT)
    participant Node as OpenAI Chat Model Node

    Note over UI,Backend: NEW: OAuth2 Device Login Flow
    UI->>Backend: GET /openai-oauth2-credential/device-auth
    Backend->>OAIAuth: POST /deviceauth/usercode (Request Challenge)
    OAIAuth-->>Backend: Return {user_code, device_auth_id}
    Backend-->>UI: Render HTML with Code & Verification Link
    
    Note over UI,OAIAuth: User manually verifies code on OpenAI site
    
    loop Polling Status
        Backend->>OAIAuth: POST /deviceauth/token
        alt Pending
            OAIAuth-->>Backend: 403 Forbidden / 404 Not Found
        else Success
            OAIAuth-->>Backend: 200 OK {authorization_code}
        end
    end

    Backend->>OAIAuth: POST /oauth/token (Exchange Code)
    OAIAuth-->>Backend: Access Token
    Backend->>Backend: NEW: Encrypt and save to "openAiOAuth2Api" credential

    Note over UI,OAICodex: NEW: Chat Execution Flow (OAuth Path)
    UI->>Node: Execute Workflow (Authentication = 'oAuth2')
    Node->>Node: CHANGED: Load 'openAiOAuth2Api' credentials
    Node->>Node: NEW: Instantiate OpenAiAccountChatModel

    Node->>OAICodex: POST /backend-api/codex/responses
    Note right of Node: Maps LangChain messages to Codex protocol

    alt Streaming Response
        loop Every Chunk
            OAICodex-->>Node: SSE: text-delta or tool-call-delta
            Node-->>UI: Stream chunk to Editor
        end
    else Standard Response
        OAICodex-->>Node: SSE: response.completed
        Node-->>UI: Return final AIMessage
    end

    Note over Node,OAICodex: NEW: Follow-up Prompt Logic
    opt Consecutive Calls
        Node->>Node: Store previous_response_id
        Node->>OAICodex: POST /codex/responses (including previous_response_id)
        Note right of Node: Enables stateful incremental prompts
    end

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[jadcoder]

Is this a feature that is under development? Does it mean that it's gonna be available soon or might it be dropped?
Thank you.

[EtienneLescot]

Is this a feature that is under development? Does it mean that it's gonna be available soon or might it be dropped? Thank you.

@jadcoder this feature is ready. simply waiting to be merged by mainteners.

[jd-solanki]

Can we have this please? I thought n8n allows using my ChatGPT subscription for Agent nodes.

[Prakashmaheshwaran]

such a wonderful feature, hope this gets progress.

[nicekon]

i want it!!!!!!!

[n8n-assistant]

This PR currently has merge conflicts with master, so we can't move it forward as-is.

Could you bring your branch up to date and resolve the conflicts? Either rebase onto master or merge it into your branch — whichever you're more comfortable with.

Our contributing guide covers setting up the repo locally if you need it.

Once you've pushed the resolved branch, this PR will automatically return to triage. If you run into trouble, reply here and we'll help.

[EtienneLescot]

Rebased onto master, conflicts resolved and pushed.

A few things changed while rebasing:

• Dropped __skipHttpRequestDomainRestrictions. Master now ships hideDomainRestrictionFields, which does the same job upstream of the field injection, so CredentialEdit.vue and CredentialIcon.vue are no longer touched at all.
• Renamed __hideOAuthRedirectUrl to hideOAuthRedirectUrl, to match the convention on master where the __ prefix marks server-computed fields.
• OAuth model discovery now goes through proxyFetch with the secure-egress lookup, like the API key path.
• Options the Codex backend cannot honour are hidden for OpenAI Account auth instead of being visible but ignored. Both points were raised by cubic.
• Picked up master drift in the device auth page: CSP nonce on the inline script, window.opener postMessage next to BroadcastChannel, BROWSER_ID_STORAGE_KEY, and getCredentialForAuthFlow for the permission check. The new tests moved from Jest to Vitest.
• Replaced the hand-rolled SSE parser and Zod to JSON Schema converter with the helpers master exports.

Typecheck, lint and the tests for the touched packages pass.