config-sample.md Codex Docs, 2026-03-13 00:34 UTC → 2026-04-10 18:23 UTC

107# - untrusted: only known-safe read-only commands auto-run; others prompt107# - untrusted: only known-safe read-only commands auto-run; others prompt

108# - on-request: model decides when to ask (default)108# - on-request: model decides when to ask (default)

109# - never: never prompt (risky)109# - never: never prompt (risky)

110# - { reject = { ... } }: auto-reject selected prompt categories110# - { granular = { ... } }: allow or auto-reject selected prompt categories

111approval_policy = "on-request"111approval_policy = "on-request"

112# Example granular auto-reject policy:112# Example granular policy:

113# approval_policy = { reject = { sandbox_approval = true, rules = false, mcp_elicitations = false } }113# approval_policy = { granular = {

114# sandbox_approval = true,

115# rules = true,

116# mcp_elicitations = true,

117# request_permissions = false,

118# skill_approval = false

119# } }

114 120 

115# Allow login-shell semantics for shell-based tools when they request `login = true`.121# Allow login-shell semantics for shell-based tools when they request `login = true`.

116# Default: true. Set false to force non-login shells and reject explicit login-shell requests.122# Default: true. Set false to force non-login shells and reject explicit login-shell requests.

132# Base URL for ChatGPT auth flow (not OpenAI API).138# Base URL for ChatGPT auth flow (not OpenAI API).

133chatgpt_base_url = "https://chatgpt.com/backend-api/"139chatgpt_base_url = "https://chatgpt.com/backend-api/"

134 140 

141# Optional base URL override for the built-in OpenAI provider.

142# openai_base_url = "https://us.api.openai.com/v1"

143 

135# Restrict ChatGPT login to a specific workspace id. Default: unset.144# Restrict ChatGPT login to a specific workspace id. Default: unset.

136# forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"145# forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"

137 146 

341# hide_rate_limit_model_nudge = true350# hide_rate_limit_model_nudge = true

342# hide_gpt5_1_migration_prompt = true351# hide_gpt5_1_migration_prompt = true

343# "hide_gpt-5.1-codex-max_migration_prompt" = true352# "hide_gpt-5.1-codex-max_migration_prompt" = true

344# model_migrations = { "gpt-4.1" = "gpt-5.1" }353# model_migrations = { "gpt-5.3-codex" = "gpt-5.4" }

345 354 

346################################################################################355################################################################################

347# Centralized Feature Flags (preferred)356# Centralized Feature Flags (preferred)

351# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.360# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.

352# shell_tool = true361# shell_tool = true

353# apps = false362# apps = false

354# apps_mcp_gateway = false363# codex_hooks = false

355# unified_exec = false364# unified_exec = true

356# shell_snapshot = false365# shell_snapshot = true

357# multi_agent = false366# multi_agent = true

358# personality = true367# personality = true

359# use_linux_sandbox_bwrap = false

360# runtime_metrics = true

361# powershell_utf8 = true

362# child_agents_md = false

363# sqlite = true

364# fast_mode = true368# fast_mode = true

369# smart_approvals = false

365# enable_request_compression = true370# enable_request_compression = true

366# image_generation = false

367# skill_mcp_dependency_install = true371# skill_mcp_dependency_install = true

368# skill_env_var_dependency_prompt = false

369# default_mode_request_user_input = false

370# artifact = false

371# prevent_idle_sleep = false372# prevent_idle_sleep = false

372# responses_websockets = false

373# responses_websockets_v2 = false

374# image_detail_original = false

375 373 

376################################################################################374################################################################################

377# Define MCP servers under this table. Leave empty to disable.375# Define MCP servers under this table. Leave empty to disable.