1# Access tokens1# Access tokens
2 2
3Codex access tokens let trusted automation run Codex local with a ChatGPT workspace identity. Use them when a script, scheduled job, or CI runner needs repeatable, non-interactive Codex access.3Codex access tokens are ChatGPT access tokens scoped to Codex permissions that let trusted automation run Codex local with a ChatGPT workspace identity. Use them when a script, scheduled job, or CI runner needs repeatable, non-interactive Codex access.
4 4
5Codex access tokens are currently supported for ChatGPT Business and5Codex access tokens are currently supported for ChatGPT Business and
6 Enterprise workspaces.6 Enterprise workspaces.
11 Codex access tokens when the workflow specifically needs ChatGPT workspace11 Codex access tokens when the workflow specifically needs ChatGPT workspace
12 access, ChatGPT-managed Codex entitlements, or enterprise workspace controls.12 access, ChatGPT-managed Codex entitlements, or enterprise workspace controls.
13 13
14Need to trigger a published ChatGPT workspace agent from your own system? Use
15 a Workspace Agent access token for the Workspace Agents API instead. Codex
16 access tokens authenticate Codex local workflows; they do not authenticate
17 workspace agent trigger calls. See [Authenticate with Workspace Agent access
18 tokens](https://developers.openai.com/workspace-agents/authentication).
19
14## How access tokens work20## How access tokens work
15 21
16Use an access token when Codex needs to run without a user completing a browser sign-in. The token represents the ChatGPT workspace user who created it, so runs can use that user's Codex access and appear in workspace governance data.22Use an access token when Codex needs to run without a user completing a browser sign-in. The token represents the ChatGPT workspace user who created it, so runs can use that user's Codex access and appear in workspace governance data.
29- **Untrusted runners:** public CI, forked pull requests, or shared machines can expose tokens to people outside your workspace. Use access tokens only on trusted runners.35- **Untrusted runners:** public CI, forked pull requests, or shared machines can expose tokens to people outside your workspace. Use access tokens only on trusted runners.
30- **Shared identities:** one person's token reused across unrelated teams makes ownership and audit trails harder to interpret. Create tokens for a specific workflow owner.36- **Shared identities:** one person's token reused across unrelated teams makes ownership and audit trails harder to interpret. Create tokens for a specific workflow owner.
31- **Stale credentials:** long-lived tokens can remain active after the workflow changes. Prefer finite expirations and revoke tokens that are no longer used.37- **Stale credentials:** long-lived tokens can remain active after the workflow changes. Prefer finite expirations and revoke tokens that are no longer used.
32- **Wrong credential type:** access tokens are for Codex local workflows. Use Platform API keys for general OpenAI API calls.38- **Wrong credential type:** Codex access tokens are for Codex local workflows. Use Workspace Agent access tokens to trigger published ChatGPT workspace agents, and use Platform API keys for general OpenAI API calls.
33 39
34## Enable access token creation40## Enable access token creation
35 41
36Use the Codex Local controls in workspace settings to turn on access token creation for allowed members.42Use the access token permission in workspace settings to turn on access token creation for allowed members.
37 43
38<CodexScreenshot44<CodexScreenshot
39 alt="Access token access permission in ChatGPT workspace RBAC settings"45 alt="Access token access permission in ChatGPT workspace RBAC settings"
44/>50/>
45 51
461. Go to [Workspace Settings > Permissions & roles](https://chatgpt.com/admin/settings).521. Go to [Workspace Settings > Permissions & roles](https://chatgpt.com/admin/settings).
472. In the Codex Local section, make sure **Allow members to use Codex Local** is turned on.532. In the **Access tokens** section, turn on **Allow users to create access tokens** if all allowed members should be able to create access tokens.
483. Turn on **Allow members to use Codex access tokens** if all allowed members should be able to create access tokens.543. If members need to use those tokens with the Codex app, CLI, or IDE extension, make sure **Allow members to use Codex Local** is also turned on in the **Codex Local** section.
494. If you use custom roles for a narrower rollout, assign the access token permission only to groups that need to create tokens.
50 55
51Keep access token creation limited to people or service owners who understand where the token will be stored, which automation will use it, and how it will be rotated.56Keep access token creation limited to people or service owners who understand where the token will be stored, which automation will use it, and how it will be rotated.
52 57
127 132
128## Permission model133## Permission model
129 134
130Access token permissions are separate from the general Codex local permission. A member can have access to the Codex app, CLI, or IDE extension without being allowed to create access tokens.135Access token creation is controlled by the workspace's access token permission, which is separate from the general Codex local permission. A member can have access to the Codex app, CLI, or IDE extension without being allowed to create access tokens.
131 136
132| Capability | Workspace owners and admins | Member with access token permission | Member without access token permission |137| Capability | Workspace owners and admins | Member with access token permission | Member without access token permission |
133| ------------------------------------------------------------- | ---------------------------------------------------- | --------------------------------------------- | -------------------------------------- |138| ------------------------------------------------------------- | ---------------------------------------------------- | --------------------------------------------- | -------------------------------------- |
144 149
145### The access tokens page returns 404 or forbidden150### The access tokens page returns 404 or forbidden
146 151
147Ask a workspace owner or admin to confirm that Codex access tokens are enabled and that your role includes the access token permission.152Ask a workspace owner or admin to confirm that your role includes **Allow users to create access tokens** and that **Allow members to use Codex Local** is enabled if you plan to use the token with Codex.
148 153
149### `codex login --with-access-token` fails154### `codex login --with-access-token` fails
150 155
