config-sample.md Codex Docs, 2026-03-13 00:34 UTC → 2026-03-20 00:35 UTC

107# - untrusted: only known-safe read-only commands auto-run; others prompt107# - untrusted: only known-safe read-only commands auto-run; others prompt

108# - on-request: model decides when to ask (default)108# - on-request: model decides when to ask (default)

109# - never: never prompt (risky)109# - never: never prompt (risky)

110# - { reject = { ... } }: auto-reject selected prompt categories110# - { granular = { ... } }: allow or auto-reject selected prompt categories

111approval_policy = "on-request"111approval_policy = "on-request"

112# Example granular auto-reject policy:112# Example granular policy:

113# approval_policy = { reject = { sandbox_approval = true, rules = false, mcp_elicitations = false } }113# approval_policy = { granular = {

114# sandbox_approval = true,

115# rules = true,

116# mcp_elicitations = true,

117# request_permissions = false,

118# skill_approval = false

119# } }

114 120 

115# Allow login-shell semantics for shell-based tools when they request `login = true`.121# Allow login-shell semantics for shell-based tools when they request `login = true`.

116# Default: true. Set false to force non-login shells and reject explicit login-shell requests.122# Default: true. Set false to force non-login shells and reject explicit login-shell requests.

132# Base URL for ChatGPT auth flow (not OpenAI API).138# Base URL for ChatGPT auth flow (not OpenAI API).

133chatgpt_base_url = "https://chatgpt.com/backend-api/"139chatgpt_base_url = "https://chatgpt.com/backend-api/"

134 140 

141# Optional base URL override for the built-in OpenAI provider.

142# openai_base_url = "https://us.api.openai.com/v1"

143 

135# Restrict ChatGPT login to a specific workspace id. Default: unset.144# Restrict ChatGPT login to a specific workspace id. Default: unset.

136# forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"145# forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"

137 146 

351# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.360# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.

352# shell_tool = true361# shell_tool = true

353# apps = false362# apps = false

354# apps_mcp_gateway = false363# unified_exec = true

355# unified_exec = false364# shell_snapshot = true

356# shell_snapshot = false365# multi_agent = true

357# multi_agent = false

358# personality = true366# personality = true

359# use_linux_sandbox_bwrap = false

360# runtime_metrics = true

361# powershell_utf8 = true

362# child_agents_md = false

363# sqlite = true

364# fast_mode = true367# fast_mode = true

368# smart_approvals = false

365# enable_request_compression = true369# enable_request_compression = true

366# image_generation = false

367# skill_mcp_dependency_install = true370# skill_mcp_dependency_install = true

368# skill_env_var_dependency_prompt = false

369# default_mode_request_user_input = false

370# artifact = false

371# prevent_idle_sleep = false371# prevent_idle_sleep = false

372# responses_websockets = false

373# responses_websockets_v2 = false

374# image_detail_original = false

375 372 

376################################################################################373################################################################################

377# Define MCP servers under this table. Leave empty to disable.374# Define MCP servers under this table. Leave empty to disable.