auth.md +41 −1
20 20
21When you sign in with ChatGPT from the Codex app, CLI, or IDE Extension, Codex opens a browser window for you to complete the login flow. After you sign in, the browser returns an access token to the CLI or IDE extension.21When you sign in with ChatGPT from the Codex app, CLI, or IDE Extension, Codex opens a browser window for you to complete the login flow. After you sign in, the browser returns an access token to the CLI or IDE extension.
22 22
23If your environment already provides a ChatGPT access token, the CLI can read
24it from stdin:
25
26```shell
27printenv CODEX_ACCESS_TOKEN | codex login --with-access-token
28```
29
23### Sign in with an API key30### Sign in with an API key
24 31
25You can also sign in to the Codex app, CLI, or IDE Extension with an API key. Get your API key from the [OpenAI dashboard](https://platform.openai.com/api-keys).32You can also sign in to the Codex app, CLI, or IDE Extension with an API key. Get your API key from the [OpenAI dashboard](https://platform.openai.com/api-keys).
30available only when you sign in with ChatGPT. If you sign in with an API key,37available only when you sign in with ChatGPT. If you sign in with an API key,
31Codex uses standard API pricing instead.38Codex uses standard API pricing instead.
32 39
3340Recommendation is to use API key authentication for programmatic Codex CLI workflows (for example CI/CD jobs). Don't expose Codex execution in untrusted or public environments.We recommend API key authentication for programmatic Codex CLI workflows, such
41as CI/CD jobs. Don't expose Codex execution in untrusted or public environments.
42
43### Use Codex access tokens for enterprise automation
44
45In ChatGPT Enterprise workspaces, admins can allow permitted members to create
46Codex access tokens for trusted, non-interactive Codex local workflows. Use an
47access token when automation needs ChatGPT workspace access, ChatGPT-managed
48Codex entitlements, or enterprise workspace controls without a browser sign-in.
49
50Access tokens are intended for trusted scripts, schedulers, and private CI
51runners. For general OpenAI API calls, continue to use Platform API keys.
52
53For setup steps, permissions, rotation, and revocation guidance, see
54[Access tokens](https://developers.openai.com/codex/enterprise/access-tokens).
34 55
35## Secure your Codex cloud account56## Secure your Codex cloud account
36 57
91 112
92These settings are commonly applied via managed configuration rather than per-user setup. See [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration).113These settings are commonly applied via managed configuration rather than per-user setup. See [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration).
93 114
115## Login diagnostics
116
117Direct `codex login` runs write a dedicated `codex-login.log` file under
118your configured log directory. Use it when you need to debug browser-login or
119device-code failures, or when support asks for login-specific logs.
120
121## Custom CA bundles
122
123If your network uses a corporate TLS proxy or private root CA, set
124`CODEX_CA_CERTIFICATE` to a PEM bundle before logging in. When
125`CODEX_CA_CERTIFICATE` is unset, Codex falls back to `SSL_CERT_FILE`. The same
126custom CA settings apply to login, normal HTTPS requests, and secure WebSocket
127connections.
128
129```shell
130export CODEX_CA_CERTIFICATE=/path/to/corporate-root-ca.pem
131codex login
132```
133
94## Login on headless devices134## Login on headless devices
95 135
96If you are signing in to ChatGPT with the Codex CLI, there are some situations where the browser-based login UI may not work:136If you are signing in to ChatGPT with the Codex CLI, there are some situations where the browser-based login UI may not work: