auth.md Codex Docs, 2026-04-30 18:36 UTC → 2026-05-18 22:01 UTC

20 20 

21When you sign in with ChatGPT from the Codex app, CLI, or IDE Extension, Codex opens a browser window for you to complete the login flow. After you sign in, the browser returns an access token to the CLI or IDE extension.21When you sign in with ChatGPT from the Codex app, CLI, or IDE Extension, Codex opens a browser window for you to complete the login flow. After you sign in, the browser returns an access token to the CLI or IDE extension.

22 22 

23If your environment already provides a ChatGPT access token, the CLI can read

24it from stdin:

25 

26```shell

27printenv CODEX_ACCESS_TOKEN | codex login --with-access-token

28```

29 

23### Sign in with an API key30### Sign in with an API key

24 31 

25You can also sign in to the Codex app, CLI, or IDE Extension with an API key. Get your API key from the [OpenAI dashboard](https://platform.openai.com/api-keys).32You can also sign in to the Codex app, CLI, or IDE Extension with an API key. Get your API key from the [OpenAI dashboard](https://platform.openai.com/api-keys).

30available only when you sign in with ChatGPT. If you sign in with an API key,37available only when you sign in with ChatGPT. If you sign in with an API key,

31Codex uses standard API pricing instead.38Codex uses standard API pricing instead.

32 39 

33Recommendation is to use API key authentication for programmatic Codex CLI workflows (for example CI/CD jobs). Don't expose Codex execution in untrusted or public environments.40We recommend API key authentication for programmatic Codex CLI workflows, such

41as CI/CD jobs. Don't expose Codex execution in untrusted or public environments.

42 

43### Use Codex access tokens for enterprise automation

44 

45In ChatGPT Enterprise workspaces, admins can allow permitted members to create

46Codex access tokens for trusted, non-interactive Codex local workflows. Use an

47access token when automation needs ChatGPT workspace access, ChatGPT-managed

48Codex entitlements, or enterprise workspace controls without a browser sign-in.

49 

50Access tokens are intended for trusted scripts, schedulers, and private CI

51runners. For general OpenAI API calls, continue to use Platform API keys.

52 

53For setup steps, permissions, rotation, and revocation guidance, see

54[Access tokens](https://developers.openai.com/codex/enterprise/access-tokens).

34 55 

35## Secure your Codex cloud account56## Secure your Codex cloud account

36 57 

102If your network uses a corporate TLS proxy or private root CA, set123If your network uses a corporate TLS proxy or private root CA, set

103`CODEX_CA_CERTIFICATE` to a PEM bundle before logging in. When124`CODEX_CA_CERTIFICATE` to a PEM bundle before logging in. When

104`CODEX_CA_CERTIFICATE` is unset, Codex falls back to `SSL_CERT_FILE`. The same125`CODEX_CA_CERTIFICATE` is unset, Codex falls back to `SSL_CERT_FILE`. The same

105custom CA settings apply to login, normal HTTPS requests, and secure websocket126custom CA settings apply to login, normal HTTPS requests, and secure WebSocket

106connections.127connections.

107 128 

108```shell129```shell