auth.md +11 −0
9 9
10Codex cloud requires signing in with ChatGPT. The Codex CLI and IDE extension support both sign-in methods.10Codex cloud requires signing in with ChatGPT. The Codex CLI and IDE extension support both sign-in methods.
11 11
12Your sign-in method also determines which admin controls and data-handling policies apply.
13
14- With sign in with ChatGPT, Codex usage follows your ChatGPT workspace permissions, RBAC, and ChatGPT Enterprise retention and residency settings
15- With an API key, usage follows your API organization's retention and data-sharing settings instead
16
17For the CLI, Sign in with ChatGPT is the default authentication path when no valid session is available.
18
12### Sign in with ChatGPT19### Sign in with ChatGPT
13 20
14When you sign in with ChatGPT from the Codex app, CLI, or IDE Extension, Codex opens a browser window for you to complete the login flow. After you sign in, the browser returns an access token to the CLI or IDE extension.21When you sign in with ChatGPT from the Codex app, CLI, or IDE Extension, Codex opens a browser window for you to complete the login flow. After you sign in, the browser returns an access token to the CLI or IDE extension.
19 26
20OpenAI bills API key usage through your OpenAI Platform account at standard API rates. See the [API pricing page](https://openai.com/api/pricing/).27OpenAI bills API key usage through your OpenAI Platform account at standard API rates. See the [API pricing page](https://openai.com/api/pricing/).
21 28
29Recommendation is to use API key authentication for programmatic Codex CLI workflows (for example CI/CD jobs). Do not expose Codex execution in untrusted or publicly triggerable environments.
30
22## Secure your Codex cloud account31## Secure your Codex cloud account
23 32
24Codex cloud interacts directly with your codebase, so it needs stronger security than many other ChatGPT features. Enable multi-factor authentication (MFA).33Codex cloud interacts directly with your codebase, so it needs stronger security than many other ChatGPT features. Enable multi-factor authentication (MFA).
43 52
44Codex caches login details locally in a plaintext file at `~/.codex/auth.json` or in your OS-specific credential store.53Codex caches login details locally in a plaintext file at `~/.codex/auth.json` or in your OS-specific credential store.
45 54
55For sign in with ChatGPT sessions, Codex refreshes tokens automatically during use before they expire, so active sessions usually continue without requiring another browser login.
56
46## Credential storage57## Credential storage
47 58
48Use `cli_auth_credentials_store` to control where the Codex CLI stores cached credentials:59Use `cli_auth_credentials_store` to control where the Codex CLI stores cached credentials: