enterprise/sign-in-with-chatgpt-through-a-gateway.md +0 −166 deleted
File Deleted View Diff
1# Sign in with ChatGPT through a gateway
2
3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.
4
5## Why you would want this
6
7{/* vale Microsoft.Foreign = NO */}
8
9If you already have a model gateway and use Codex with the API Platform, you can keep your gateway while moving to **Sign in with ChatGPT**. This gives you access to eligible ChatGPT workspace features and controls (e.g. [**voice mode**](#voice-through-a-gateway)) while keeping your model gateway. Compare the sign-in methods in [Feature availability](https://learn.chatgpt.com/docs/pricing#feature-availability).
10
11{/* vale Microsoft.Foreign = YES */}
12
13## How to set it up
14
15Existing [command-backed authentication](https://learn.chatgpt.com/docs/config-file/config-advanced#custom-model-providers) places the gateway key in `Authorization`. With ChatGPT sign-in, that header carries the ChatGPT token. Choose how to supply the separate gateway credential:
16
17- **Option A:** Reuse your credential command through a small launch helper. Send the same gateway key in a separate header.
18- **Option B:** Let Codex obtain the gateway credential through native OAuth.
19
20Add the selected provider configuration to your workspace's cloud-managed `requirements.toml` in [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration). These requirements apply after users sign in with ChatGPT; they do not restrict other sign-in methods. The gateway's Codex-compatible base URL must proxy `/models` and `/responses` to `https://chatgpt.com/backend-api/codex`.
21
22### Option A: Reuse your credential command with a helper
23
24Keep your existing credential command. A small helper runs it before launching Codex and exports its output as `GATEWAY_KEY`. This is the same gateway key you use today; only its delivery header changes.
25
26For example, your existing API/provider configuration might contain:
27
28```toml
29# config.toml — existing API/provider setup
30model_provider = "enterprise_gateway"
31
32[model_providers.enterprise_gateway]
33name = "Enterprise gateway"
34base_url = "https://gateway.example.com/v1"
35requires_openai_auth = false
36
37[model_providers.enterprise_gateway.auth]
38command = "/usr/local/bin/fetch-gateway-token"
39```
40
41For ChatGPT sign-in, replace that provider with the following managed configuration. Remove its `auth` block: command-backed provider auth cannot be combined with `requires_openai_auth = true`.
42
43```toml
44# requirements.toml
45model_provider = "enterprise_gateway"
46
47[model_providers.enterprise_gateway]
48name = "Enterprise gateway"
49base_url = "https://gateway.example.com/backend-api/codex" # Keep the gateway route.
50requires_openai_auth = true # Use the ChatGPT credential for OpenAI.
51env_http_headers = { "X-Gateway-Key" = "GATEWAY_KEY" } # Send the same gateway key separately.
52```
53
54Use a launch helper function to run the command from your existing `auth` block, verify that it returned a non-empty key, export the key as `GATEWAY_KEY`, and then start Codex.
55
56Configure your gateway to accept `X-Gateway-Key`, validate the key, and remove that header before forwarding the request to the backend. The request from the client now carries:
57
58```http
59POST /backend-api/codex/responses
60Authorization: Bearer <ChatGPT token>
61ChatGPT-Account-ID: <workspace ID, when available>
62X-Gateway-Key: <same gateway key returned by your command>
63```
64
65The helper runs once per launch. Codex does not rerun it or refresh this header; when the key expires, obtain a new key and relaunch. For desktop, your launch integration must supply `GATEWAY_KEY` to the app process. Choose Option B if you want Codex to manage gateway sign-in and token renewal.
66
67
68
69
70
71
72
73
74
75
76
77
78
79### Option B: Use native gateway OAuth
80
81Use this option to replace API-key or command-backed gateway authentication with Codex-managed gateway sign-in. Your gateway must have an OAuth authorization server. Register a public client that supports authorization code with PKCE, then replace the example URLs and client ID.
82
83For comparison, an existing API-key provider that reads its key from an environment variable might contain:
84
85```toml
86# config.toml — existing API-key path
87model_provider = "enterprise_gateway"
88
89[model_providers.enterprise_gateway]
90name = "Enterprise gateway"
91base_url = "https://gateway.example.com/v1"
92requires_openai_auth = false
93env_key = "CODEX_GATEWAY_API_KEY"
94```
95
96For ChatGPT sign-in, replace the existing provider with the following managed configuration:
97
98```toml
99# requirements.toml
100model_provider = "enterprise_gateway"
101
102[model_providers.enterprise_gateway]
103name = "Enterprise gateway"
104base_url = "https://gateway.example.com/backend-api/codex" # Keep the gateway route.
105requires_openai_auth = true # Use the ChatGPT credential for OpenAI.
106
107[model_providers.enterprise_gateway.gateway_oauth] # Add gateway OAuth.
108authorization_url = "https://login.example.com/oauth/authorize"
109token_url = "https://login.example.com/oauth/token"
110client_id = "YOUR_PUBLIC_CLIENT_ID"
111delivery = { kind = "cookie", name = "auth-openid" } # Add gateway auth as a cookie.
112# redirect_port = 43127
113```
114
115Codex uses a free loopback port by default. If your identity provider requires a fixed redirect URI, set `redirect_port` and register `http://127.0.0.1:43127/callback` for this example.
116
117The request from the client now carries:
118
119```http
120POST /backend-api/codex/responses
121Authorization: Bearer <ChatGPT token>
122ChatGPT-Account-ID: <workspace ID, when available>
123Cookie: auth-openid=<gateway token>
124```
125
126
127
128
129
130
131
132
133
134
135
136
137
138### Add routing headers (optional)
139
140With either option, Codex can send custom routing headers to the gateway. For example, add these headers to the same `enterprise_gateway` provider in your cloud-managed `requirements.toml`:
141
142```toml
143[model_providers.enterprise_gateway.http_headers]
144x-portkey-config = "<gateway-routing-config-id>"
145x-portkey-metadata = '{"tool_id":"codex"}'
146```
147
148Codex sends the headers on model-provider requests; the gateway applies the routing rules. Use `env_http_headers` for values read from the Codex process environment. Test a request to confirm the gateway receives both headers and selects the intended route. See [Custom model providers](https://learn.chatgpt.com/docs/config-file/config-advanced#custom-model-providers) for more header options.
149
150### Keep the credentials on their own paths
151
152Codex sends the ChatGPT `Authorization` header, any `ChatGPT-Account-ID` header, and the gateway header or cookie. Have the gateway verify and remove its credential, then forward the ChatGPT headers unchanged.
153
154## Caveats and limitations
155
156- Use a Codex build that supports managed model-provider requirements and, for Option B, native gateway OAuth. Older builds may ignore or reject unsupported fields.
157- This route covers requests through the selected model provider. ChatGPT sign-in, MCP, plugins, and other app connections can use different paths.
158- Your gateway can see request data and both credentials. Redact them in logs; never forward gateway credentials upstream.
159- Native gateway OAuth needs a browser and a reachable loopback callback. It has no device-code fallback. Without a refresh token, users must repeat browser sign-in when the access token expires.
160- A generic OpenAI `/v1/models` response is insufficient: Codex expects a `models` array. Test the model list, a prompt, and each feature your deployment uses.
161
162### Voice through a gateway
163
164This setup routes Codex model-provider requests; it does not enable [ChatGPT Voice](https://learn.chatgpt.com/docs/features/voice). For WebRTC voice sessions, call creation and the sideband connection use separate routes. The experimental `experimental_realtime_webrtc_call_base_url` setting in `~/.codex/config.toml` changes only the HTTP base URL for call creation. It does not redirect the sideband connection, media, or ordinary model requests. Work with OpenAI to verify the call destination and credential handling before using this override, then test a complete voice session.
165
166For the API/provider credential path, see [Gateway compatibility](https://learn.chatgpt.com/docs/enterprise/gateway-compatibility) and [Roll out a gateway](https://learn.chatgpt.com/docs/enterprise/roll-out-a-gateway). For these managed settings, see [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration) and the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference).