config-sample.md Codex Docs, 2026-04-25 00:42 UTC → 2026-05-18 22:01 UTC

42# Default OSS provider for --oss sessions. When unset, Codex prompts. Default: unset.42# Default OSS provider for --oss sessions. When unset, Codex prompts. Default: unset.

43# oss_provider = "ollama"43# oss_provider = "ollama"

44 44 

45# Preferred service tier. `fast` is honored only when enabled in [features].45# Preferred service tier. Built-in examples: fast | flex; model catalogs can add more.

46# service_tier = "flex" # fast | flex46# service_tier = "flex"

47 47 

48# Optional manual model metadata. When unset, Codex uses model or preset defaults.48# Optional manual model metadata. When unset, Codex uses model or preset defaults.

49# model_context_window = 128000 # tokens; default: auto for model49# model_context_window = 128000 # tokens; default: auto for model

83# Inline override for the history compaction prompt. Default: unset.83# Inline override for the history compaction prompt. Default: unset.

84# compact_prompt = ""84# compact_prompt = ""

85 85 

86# Override the default commit co-author trailer. Set to "" to disable it.86# Override the default commit co-author trailer. This only takes effect when

87# [features].codex_git_commit is enabled. When enabled and unset, Codex uses

88# "Codex <noreply@openai.com>". Set to "" to disable it.

87# commit_attribution = "Jane Doe <jane@example.com>"89# commit_attribution = "Jane Doe <jane@example.com>"

88 90 

89# Override built-in base instructions with a file path. Default: unset.91# Override built-in base instructions with a file path. Default: unset.

130# - workspace-write132# - workspace-write

131# - danger-full-access (no sandbox; extremely risky)133# - danger-full-access (no sandbox; extremely risky)

132sandbox_mode = "read-only"134sandbox_mode = "read-only"

133# Named permissions profile to apply by default. Required before using [permissions.<name>].135# Named permissions profile to apply by default. Built-ins:

134# default_permissions = "workspace"136# :read-only | :workspace | :danger-no-sandbox

137# Use a custom name such as "workspace" only when you also define [permissions.workspace].

138# default_permissions = ":workspace"

135 139 

136# Example filesystem profile. Use `"none"` to deny reads for exact paths or140# Example filesystem profile. Use `"none"` to deny reads for exact paths or

137# glob patterns. On platforms that need pre-expanded glob matches, set141# glob patterns. On platforms that need pre-expanded glob matches, set

284experimental_use_profile = false288experimental_use_profile = false

285 289 

286################################################################################290################################################################################

287# Managed network proxy settings291# Sandboxed networking settings

288################################################################################292################################################################################

289 293 

294# Enable the feature before configuring sandboxed networking rules.

295# [features.network_proxy]

296# enabled = true

297# domains = { "api.openai.com" = "allow", "example.com" = "deny" }

298#

299# Exact hosts match only themselves.

300# "*.example.com" matches subdomains only; "**.example.com" matches the apex plus subdomains.

301# "*" allows any public host that is not denied, so prefer scoped rules when possible.

302# `allow_local_binding = false` blocks loopback and private destinations by default.

303# Add an exact local IP literal or `localhost` allow rule for one target, or set it to true only when broader local access is required.

304#

290# Set `default_permissions = "workspace"` before enabling this profile.305# Set `default_permissions = "workspace"` before enabling this profile.

291# [permissions.workspace.network]306# [permissions.workspace.network]

292# enabled = true307# enabled = true

299# dangerously_allow_non_loopback_proxy = false314# dangerously_allow_non_loopback_proxy = false

300# dangerously_allow_non_loopback_admin = false315# dangerously_allow_non_loopback_admin = false

301# dangerously_allow_all_unix_sockets = false316# dangerously_allow_all_unix_sockets = false

302# mode = "limited" # limited | full

303# allow_local_binding = false317# allow_local_binding = false

304#318#

305# [permissions.workspace.network.domains]319# [permissions.workspace.network.domains]

358# You can also add custom .tmTheme files under $CODEX_HOME/themes.372# You can also add custom .tmTheme files under $CODEX_HOME/themes.

359# theme = "catppuccin-mocha"373# theme = "catppuccin-mocha"

360 374 

375# Custom key bindings. Context-specific bindings override [tui.keymap.global].

376# Use [] to unbind an action.

377# [tui.keymap.global]

378# open_transcript = "ctrl-t"

379# open_external_editor = []

380#

381# [tui.keymap.composer]

382# submit = ["enter", "ctrl-m"]

383 

361# Internal tooltip state keyed by model slug. Usually managed by Codex.384# Internal tooltip state keyed by model slug. Usually managed by Codex.

362# [tui.model_availability_nux]385# [tui.model_availability_nux]

363# "gpt-5.4" = 1386# "gpt-5.4" = 1

387# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.410# Leave this table empty to accept defaults. Set explicit booleans to opt in/out.

388# shell_tool = true411# shell_tool = true

389# apps = false412# apps = false

390# codex_hooks = false413# hooks = false

414# plugin_hooks = false # Default off; set true to opt into plugin-bundled hooks.

415# codex_git_commit = false

391# unified_exec = true416# unified_exec = true

392# shell_snapshot = true417# shell_snapshot = true

393# multi_agent = true418# multi_agent = true

394# personality = true419# personality = true

420# network_proxy = false

395# fast_mode = true421# fast_mode = true

396# enable_request_compression = true422# enable_request_compression = true

397# skill_mcp_dependency_install = true423# skill_mcp_dependency_install = true

468# - openai494# - openai

469# - ollama495# - ollama

470# - lmstudio496# - lmstudio

497# - amazon-bedrock

471# These IDs are reserved. Use a different ID for custom providers.498# These IDs are reserved. Use a different ID for custom providers.

472 499 

473[model_providers]500[model_providers]

474 501 

502# --- Example: built-in Amazon Bedrock provider options ---

503# model_provider = "amazon-bedrock"

504# model = "<bedrock-model-id>"

505# [model_providers.amazon-bedrock.aws]

506# profile = "default"

507# region = "eu-central-1"

508 

475# --- Example: OpenAI data residency with explicit base URL or headers ---509# --- Example: OpenAI data residency with explicit base URL or headers ---

476# [model_providers.openaidr]510# [model_providers.openaidr]

477# name = "OpenAI Data Residency"511# name = "OpenAI Data Residency"

542# { type = "connector", id = "gmail" },576# { type = "connector", id = "gmail" },

543# { type = "plugin", id = "figma@openai-curated" },577# { type = "plugin", id = "figma@openai-curated" },

544# ]578# ]

579# disabled_tools = [

580# { type = "plugin", id = "slack@openai-curated" },

581# { type = "connector", id = "connector_googlecalendar" },

582# ]

545 583 

546################################################################################584################################################################################

547# Profiles (named presets)585# Profiles (named presets)

554# model_provider = "openai"592# model_provider = "openai"

555# approval_policy = "on-request"593# approval_policy = "on-request"

556# sandbox_mode = "read-only"594# sandbox_mode = "read-only"

557# service_tier = "flex"595# service_tier = "flex" # or another supported service tier id

558# oss_provider = "ollama"596# oss_provider = "ollama"

559# model_reasoning_effort = "medium"597# model_reasoning_effort = "medium"

560# plan_mode_reasoning_effort = "high"598# plan_mode_reasoning_effort = "high"