auth.md Codex Docs, 2026-03-17 18:24 UTC → 2026-05-14 21:00 UTC

30available only when you sign in with ChatGPT. If you sign in with an API key,30available only when you sign in with ChatGPT. If you sign in with an API key,

31Codex uses standard API pricing instead.31Codex uses standard API pricing instead.

32 32 

33Recommendation is to use API key authentication for programmatic Codex CLI workflows (for example CI/CD jobs). Don't expose Codex execution in untrusted or public environments.33We recommend API key authentication for programmatic Codex CLI workflows, such

34as CI/CD jobs. Don't expose Codex execution in untrusted or public environments.

35 

36### Use Codex access tokens for enterprise automation

37 

38In ChatGPT Enterprise workspaces, admins can allow permitted members to create

39Codex access tokens for trusted, non-interactive Codex local workflows. Use an

40access token when automation needs ChatGPT workspace access, ChatGPT-managed

41Codex entitlements, or enterprise workspace controls without a browser sign-in.

42 

43Access tokens are intended for trusted scripts, schedulers, and private CI

44runners. For general OpenAI API calls, continue to use Platform API keys.

45 

46For setup steps, permissions, rotation, and revocation guidance, see

47[Access tokens](https://developers.openai.com/codex/enterprise/access-tokens).

34 48 

35## Secure your Codex cloud account49## Secure your Codex cloud account

36 50 

91 105 

92These settings are commonly applied via managed configuration rather than per-user setup. See [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration).106These settings are commonly applied via managed configuration rather than per-user setup. See [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration).

93 107 

108## Login diagnostics

109 

110Direct `codex login` runs write a dedicated `codex-login.log` file under

111your configured log directory. Use it when you need to debug browser-login or

112device-code failures, or when support asks for login-specific logs.

113 

114## Custom CA bundles

115 

116If your network uses a corporate TLS proxy or private root CA, set

117`CODEX_CA_CERTIFICATE` to a PEM bundle before logging in. When

118`CODEX_CA_CERTIFICATE` is unset, Codex falls back to `SSL_CERT_FILE`. The same

119custom CA settings apply to login, normal HTTPS requests, and secure websocket

120connections.

121 

122```shell

123export CODEX_CA_CERTIFICATE=/path/to/corporate-root-ca.pem

124codex login

125```

126 

94## Login on headless devices127## Login on headless devices

95 128 

96If you are signing in to ChatGPT with the Codex CLI, there are some situations where the browser-based login UI may not work:129If you are signing in to ChatGPT with the Codex CLI, there are some situations where the browser-based login UI may not work: