siwc-proxy

A local OpenAI-compatible API backed by Sign in with ChatGPT token sharing. Sign in once; the proxy keeps the ChatGPT plan credential fresh and serves /v1/chat/completions, /v1/responses, and /v1/models to any OpenAI SDK, framework, or tool that lets you set a base URL.

• Sign-in and re-auth handled for you. The proxy hosts its own OAuth callback, registers its client on first use, and reuses that registration afterwards. Authlib does PKCE, state, nonce, and ID-token checks.
• Safe token refresh. Rotating refresh tokens are refreshed once, even across processes (file lock). Refreshed tokens are saved before they are checked, so a failed check never loses the new refresh token. A temporary outage never deletes credentials. An upstream 401 triggers one refresh and retry.
• Works with ordinary client code. responses.create(input="hi") without stream/store works: the proxy streams upstream and aggregates the result. Chat Completions is translated to Responses. Options that can't be honored, such as user and seed, are dropped and listed in a response header.
• Errors in OpenAI's shape and status. For example, a plan usage limit becomes a 429 RateLimitError, so normal client backoff works.

Quick start

Install the siwc-proxy command with uv. uv gets a suitable Python (3.12+) for it if you don't have one:

uv tool install siwc-proxy

Start the proxy:

siwc-proxy serve

If you are not signed in yet, serve prints a sign-in link. Open it in a browser on the same computer, or run this in a second terminal:

siwc-proxy login

On a remote server or any machine without a browser, run siwc-proxy login --remote there instead. Open the printed link on your own computer and sign in. Then copy the http://127.0.0.1:... address the browser ends up on (the page fails to load; that is expected) and paste it back into the terminal.

Then point any OpenAI client at the proxy:

from openai import OpenAI

client = OpenAI(base_url="http://127.0.0.1:8787/v1", api_key="<local key>")
model = client.models.list().data[0].id
print(client.responses.create(model=model, input="Say hello.").output_text)

The local key is generated on first run and shown by:

siwc-proxy status --show-key

Or choose your own key with SIWC_PROXY_API_KEY. The key only protects the local proxy; it is never sent to OpenAI.

More ways to run it

• Without installing: uvx siwc-proxy serve. Put uvx in front of every siwc-proxy command in this README.

• Upgrade: uv tool upgrade siwc-proxy.

• Not on your PATH after uv tool install? Run uv tool update-shell and open a new terminal.

• pip or pipx: pipx install siwc-proxy, or pip install siwc-proxy in a virtual environment. python -m siwc_proxy works like the siwc-proxy command.

• One-file scripts with uv: declare openai inline and run the file with uv run hello.py:

  # /// script
  # dependencies = ["openai"]
  # ///
  import os
  from openai import OpenAI
  
  client = OpenAI(base_url="http://127.0.0.1:8787/v1", api_key=os.environ["SIWC_PROXY_API_KEY"])
  model = client.models.list().data[0].id
  print(client.responses.create(model=model, input="Say hello.").output_text)
  

Commands

Every command accepts --data-dir, before or after the command name (or SIWC_PROXY_DATA_DIR), to choose a credential directory. Use one directory per account.

serve --host can bind a non-loopback interface for Docker or LAN use, but the proxy speaks plain HTTP: the key and your prompts then cross the network unencrypted. See the warning in docs/proxy.md.

See docs/proxy.md for configuration, routes, the Chat translation rules, error mapping, and Docker/LAN access.

Development

git clone https://github.com/d-nyamkhuu/siwc-proxy.git
cd siwc-proxy
uv sync
uv run pytest -q
uv run siwc-proxy serve   # run the checkout

The tests run the real openai SDK against the app. OpenAI's OAuth and API are mocked: real RSA-signed ID tokens, rotating refresh tokens, and multi-process refresh races. No live account is used.

Releasing

The version lives only in pyproject.toml. Bump it, then push a matching tag:

uv version --bump minor   # or patch / major
git commit -am "Release $(uv version --short)"
git tag "v$(uv version --short)"
git push origin main --tags

The release workflow runs the tests, builds the wheel and sdist, smoke-tests both, and publishes to PyPI with Trusted Publishing, so no API token is stored. Before the first release, add a pending publisher on PyPI for project siwc-proxy, repository d-nyamkhuu/siwc-proxy, workflow release.yml, environment pypi.

References

• Token sharing for open-source and locally hosted apps
• Registration and sign-in
• Profiles and sessions
• Token reference
• Models and inference
• Preview limitations