config-sample.md Codex Docs, 2026-03-17 00:33 UTC → 2026-03-31 06:35 UTC

107# - untrusted: only known-safe read-only commands auto-run; others prompt107# - untrusted: only known-safe read-only commands auto-run; others prompt

108# - on-request: model decides when to ask (default)108# - on-request: model decides when to ask (default)

109# - never: never prompt (risky)109# - never: never prompt (risky)

110# - { reject = { ... } }: auto-reject selected prompt categories110# - { granular = { ... } }: allow or auto-reject selected prompt categories

111approval_policy = "on-request"111approval_policy = "on-request"

112# Example granular auto-reject policy:112# Example granular policy:

113# approval_policy = { reject = { sandbox_approval = true, rules = false, mcp_elicitations = false } }113# approval_policy = { granular = {

114# sandbox_approval = true,

115# rules = true,

116# mcp_elicitations = true,

117# request_permissions = false,

118# skill_approval = false

119# } }

114 120 

115# Allow login-shell semantics for shell-based tools when they request `login = true`.121# Allow login-shell semantics for shell-based tools when they request `login = true`.

116# Default: true. Set false to force non-login shells and reject explicit login-shell requests.122# Default: true. Set false to force non-login shells and reject explicit login-shell requests.

132# Base URL for ChatGPT auth flow (not OpenAI API).138# Base URL for ChatGPT auth flow (not OpenAI API).

133chatgpt_base_url = "https://chatgpt.com/backend-api/"139chatgpt_base_url = "https://chatgpt.com/backend-api/"

134 140 

141# Optional base URL override for the built-in OpenAI provider.

142# openai_base_url = "https://us.api.openai.com/v1"

143 

135# Restrict ChatGPT login to a specific workspace id. Default: unset.144# Restrict ChatGPT login to a specific workspace id. Default: unset.

136# forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"145# forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"

137 146 

351# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.360# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.

352# shell_tool = true361# shell_tool = true

353# apps = false362# apps = false

354# apps_mcp_gateway = false363# codex_hooks = false

355# unified_exec = false364# unified_exec = true

356# shell_snapshot = false365# shell_snapshot = true

366# multi_agent = true

357# personality = true367# personality = true

358# use_linux_sandbox_bwrap = false

359# runtime_metrics = true

360# powershell_utf8 = true

361# child_agents_md = false

362# sqlite = true

363# fast_mode = true368# fast_mode = true

369# smart_approvals = false

364# enable_request_compression = true370# enable_request_compression = true

365# image_generation = false

366# skill_mcp_dependency_install = true371# skill_mcp_dependency_install = true

367# skill_env_var_dependency_prompt = false

368# default_mode_request_user_input = false

369# artifact = false

370# prevent_idle_sleep = false372# prevent_idle_sleep = false

371# responses_websockets = false

372# responses_websockets_v2 = false

373# image_detail_original = false

374 373 

375################################################################################374################################################################################

376# Define MCP servers under this table. Leave empty to disable.375# Define MCP servers under this table. Leave empty to disable.