auth.md Codex Docs, 2026-03-04 06:20 UTC → 2026-03-07 00:33 UTC

85 85 

86If the active credentials don't match the configured restrictions, Codex logs the user out and exits.86If the active credentials don't match the configured restrictions, Codex logs the user out and exits.

87 87 

88These settings are commonly applied via managed configuration rather than per-user setup. See [Managed configuration](https://developers.openai.com/codex/security#managed-configuration).88These settings are commonly applied via managed configuration rather than per-user setup. See [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration).

89 89 

90## Login on headless devices90## Login on headless devices

91 91 

141docker cp ~/.codex/auth.json MY_CONTAINER:"$CONTAINER_HOME/.codex/auth.json"141docker cp ~/.codex/auth.json MY_CONTAINER:"$CONTAINER_HOME/.codex/auth.json"

142```142```

143 143 

144For a more advanced version of this same pattern on trusted CI/CD runners, see

145[Maintain Codex account auth in CI/CD (advanced)](https://developers.openai.com/codex/auth/ci-cd-auth).

146That guide explains how to let Codex refresh `auth.json` during normal runs and

147then keep the updated file for the next job. API keys are still the recommended

148default for automation.

149 

144### Fallback: Forward the localhost callback over SSH150### Fallback: Forward the localhost callback over SSH

145 151 

146If you can forward ports between your local machine and the remote host, you can use the standard browser-based flow by tunneling Codex's local callback server (default `localhost:1455`).152If you can forward ports between your local machine and the remote host, you can use the standard browser-based flow by tunneling Codex's local callback server (default `localhost:1455`).