1# Environment variables – Codex
2
3Codex uses `config.toml` for durable settings. Use environment variables for
4shell-scoped overrides, automation secrets, installer behavior, or diagnostics.
5
6This page lists stable public environment variables that Codex reads directly.
7It does not list internal development variables, test variables, or
8provider-specific secret names you choose yourself with
9[`env_key`](https://developers.openai.com/codex/config-advanced#custom-model-providers).
10
11## Core locations
12
13| Variable | Used by | Default | Description |
14| --- | --- | --- | --- |
15| `CODEX_HOME` | CLI, IDE extension, app-server, installers | `~/.codex` | Sets the root for Codex state, including config, auth, logs, sessions, skills, and standalone package metadata. If you set it, the directory must already exist. |
16| `CODEX_SQLITE_HOME` | CLI and app-server state | `CODEX_HOME` | Sets where SQLite-backed state is stored. The `sqlite_home` config option takes precedence. Relative paths resolve from the current working directory. |
17
18For more about the files stored under `CODEX_HOME`, see
19[Config and state locations](https://developers.openai.com/codex/config-advanced#config-and-state-locations).
20
21## Installer variables
22
23These variables apply to the standalone install scripts served from
24`https://chatgpt.com/codex/install.sh` and
25`https://chatgpt.com/codex/install.ps1`.
26
27| Variable | Default | Description |
28| --- | --- | --- |
29| `CODEX_NON_INTERACTIVE` | `false` | Set to `1`, `true`, or `yes` to skip installer prompts. Prompts use their default response, so use this for scripted installs and updates, not first-run setup. |
30| `CODEX_INSTALL_DIR` | `~/.local/bin` on macOS/Linux; `%LOCALAPPDATA%\Programs\OpenAI\Codex\bin` on Windows | Changes where the visible `codex` command is installed. The standalone package cache still lives under `CODEX_HOME/packages/standalone`. |
31
32For unattended installs, set `CODEX_NON_INTERACTIVE=1` on the shell that runs
33the downloaded installer:
34
35```
36curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 sh
37```
38
39```
40$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex
41```
42
43## Authentication and network
44
45| Variable | Used by | Description |
46| --- | --- | --- |
47| `CODEX_API_KEY` | `codex exec` | Provides an API key for a single non-interactive run. This is only supported in `codex exec`; set it inline rather than job-wide when running repository-controlled code. |
48| `CODEX_ACCESS_TOKEN` | CLI, app-server, trusted automation | Provides a ChatGPT or Codex access token for trusted automation. For persisted login, pipe it to `codex login --with-access-token`. |
49| `CODEX_CA_CERTIFICATE` | HTTPS, login, and WebSocket clients | Points to a PEM CA bundle for environments with corporate TLS interception or private root CAs. Takes precedence over `SSL_CERT_FILE`. |
50| `SSL_CERT_FILE` | HTTPS, login, and WebSocket clients | Fallback PEM CA bundle path when `CODEX_CA_CERTIFICATE` is unset. |
51
52For provider API keys, set
53[`env_key`](https://developers.openai.com/codex/config-advanced#custom-model-providers) in the model provider
54configuration. Codex reads the variable named by that config, so the variable
55name itself is not a fixed Codex environment variable.
56
57For automation secret handling, see
58[Use API key auth](https://developers.openai.com/codex/noninteractive#use-api-key-auth).
59For access token setup, see [Access tokens](https://developers.openai.com/codex/enterprise/access-tokens).
60
61## Diagnostics
62
63| Variable | Used by | Description |
64| --- | --- | --- |
65| `RUST_LOG` | CLI and app-server | Controls Rust log filtering and verbosity. `codex exec` defaults to `error` output unless you set a more verbose value. |
66
67`RUST_LOG` accepts values such as `error`, `warn`, `info`, `debug`, and
68`trace`. It also accepts more targeted Rust logging filters, such as
69`codex_core=debug,codex_tui=debug`.
70
71The interactive CLI records diagnostics in bounded local stores by default, but
72the plaintext `codex-tui.log` file is opt-in. Set `log_dir` explicitly when you
73need a plaintext log for troubleshooting:
74
75```
76RUST_LOG=debug codex -c log_dir=./.codex-log
77tail -F ./.codex-log/codex-tui.log
78```
79
80In non-interactive mode, `codex exec` prints messages inline instead of writing
81to a separate TUI log file.
82