enterprise/admin-setup diff

enterprise/admin-setup.md +371 −87

Details

1# Admin Setup1# Admin Setup

2 2

3<div class="max-w-1xl mx-auto">

4 <img src="https://developers.openai.com/images/codex/codex_enterprise_admin.png"

5 alt="Codex enterprise admin toggle"

6 class="block w-full mx-auto rounded-lg"

7 />

8</div>

3This guide is for ChatGPT Enterprise admins who want to set up Codex for their workspace.12This guide is for ChatGPT Enterprise admins who want to set up Codex for their workspace.

4 13

14Use this page as the step-by-step rollout guide. For detailed policy, configuration, automation, and monitoring details, use the linked pages: [Authentication](https://developers.openai.com/codex/auth), [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security), [Access tokens](https://developers.openai.com/codex/enterprise/access-tokens), [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), and [Governance](https://developers.openai.com/codex/enterprise/governance).

5## Enterprise-grade security and privacy16## Enterprise-grade security and privacy

6 17

7Codex supports ChatGPT Enterprise security features, including:18Codex supports ChatGPT Enterprise security features, including:

8 19

9- No training on enterprise data20- No training on enterprise data

~~10- Zero data retention for the CLI and IDE~~21- Zero data retention for the App, CLI, and IDE (code stays in the developer environment)

~~11- Residency and retention follow ChatGPT Enterprise policies~~22- Residency and retention that follow ChatGPT Enterprise policies

12- Granular user access controls23- Granular user access controls

~~13- Data encryption at rest (AES 256) and in transit (TLS 1.2+)~~24- Data encryption at rest (AES-256) and in transit (TLS 1.2+)

25- Audit logging via the ChatGPT Compliance API

14 26

~~15For more, see [Security](https://developers.openai.com/codex/security).~~27For security controls and runtime protections, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security). Refer to [Zero Data Retention (ZDR)](https://platform.openai.com/docs/guides/your-data#zero-data-retention) for more details.

28For a broader enterprise security overview, see the [Codex security white paper](https://trust.openai.com/?itemUid=382f924d-54f3-43a8-a9df-c39e6c959958&source=click).

16 29

~~17## Local vs. cloud setup~~30## Pre-requisites: Determine owners and rollout strategy

18 31

~~19Codex operates in two environments: local and cloud.~~32During your rollout, team members may support different aspects of integrating Codex into your organization. Ensure you have the following owners:

20 33

~~211. Local use includes the Codex app, CLI, and IDE extension. The agent runs on the developer’s computer in a sandbox.~~34- **ChatGPT Enterprise workspace owner:** required to configure Codex settings in your workspace.

222. Use in the cloud includes Codex cloud, iOS, Code Review, and tasks created by the [Slack integration](https://developers.openai.com/codex/integrations/slack). The agent runs remotely in a hosted container with your codebase.35- **Security owner:** determines agent permissions settings for Codex.

36- **Analytics owner:** integrates analytics and compliance APIs into your data pipelines.

23 37

~~24Use separate permissions and role-based access control (RBAC) to control access to local and cloud features. You can enable local, cloud, or both for all users or for specific groups.~~38Decide which Codex surfaces you will use:

25 39

~~26## Codex local setup~~40- **Codex local:** includes the Codex app, CLI, and IDE extension. The agent runs on the developer's computer in a sandbox.

41- **Codex cloud:** includes hosted Codex features (including Codex cloud, iOS, Code Review, and tasks created by the [Slack integration](https://developers.openai.com/codex/integrations/slack) or [Linear integration](https://developers.openai.com/codex/integrations/linear)). The agent runs remotely in a hosted container with your codebase.

42- **Both:** use local + cloud together.

27 43

~~28### Enable Codex app, CLI, and IDE extension in workspace settings~~44You can enable local, cloud, or both, and control access with workspace settings and role-based access control (RBAC).

29 45

30To enable Codex locally for workspace members, go to [Workspace Settings > Settings and Permissions](https://chatgpt.com/admin/settings). Turn on **Allow members to use Codex Local**. This setting doesn’t require the GitHub connector.46## Step 1: Enable Codex in your workspace

31 47

32After you turn this on, users can sign in to use the Codex app, CLI, and IDE extension with their ChatGPT account. If you turn off this setting, users who attempt to use the Codex app, CLI, or IDE will see the following error: “403 - Unauthorized. Contact your ChatGPT administrator for access.”48You configure access to Codex in ChatGPT Enterprise workspace settings.

33 49

~~34## Team Config~~50Go to [Workspace Settings > Settings and Permissions](https://chatgpt.com/admin/settings).

35 51

~~36Teams who want to standardize Codex across an organization can use Team Config to share defaults, rules, and skills without duplicating setup on every local configuration.~~52### Codex local

37 53

~~38| Type | Path | Use it to |~~54Codex local is enabled by default for new ChatGPT Enterprise workspaces. If

~~39| ------------------------------------ | ------------- | ---------------------------------------------------------------------------- |~~55 you are not a ChatGPT workspace owner, you can test whether you have access by

~~40| [Config basics](https://developers.openai.com/codex/config-basic) | `config.toml` | Set defaults for sandbox mode, approvals, model, reasoning effort, and more. |~~56 [installing Codex](https://developers.openai.com/codex/quickstart) and logging in with your work email.

~~41| [Rules](https://developers.openai.com/codex/rules) | `rules/` | Control which commands Codex can run outside the sandbox. |~~

~~42| [Skills](https://developers.openai.com/codex/skills) | `skills/` | Make shared skills available to your team. |~~

43 57

~~44For locations and precedence, see [Config basics](https://developers.openai.com/codex/config-basic#configuration-precedence).~~58Turn on **Allow members to use Codex Local**.

60This enables use of the Codex app, CLI, and IDE extension for allowed users.

62If members need programmatic Codex local workflows, also turn on **Allow members to use Codex access tokens** or grant the access token permission through a custom role. For setup and permission details, see [Access tokens](https://developers.openai.com/codex/enterprise/access-tokens).

45 63

~~46## Codex cloud setup~~64If the Codex Local toggle is off, users who attempt to use the Codex app, CLI, or IDE will see the following error: “403 - Unauthorized. Contact your ChatGPT administrator for access.”

66#### Enable device code authentication for Codex CLI

68Allow developers to sign in with a device code when using Codex CLI in a non-interactive environment (for example, a remote development box). More details are in [authentication](https://developers.openai.com/codex/auth/).

70<div class="max-w-1xl mx-auto py-1">

71 <img src="https://developers.openai.com/images/codex/enterprise/local-toggle-config.png"

72 alt="Codex local toggle"

73 class="block w-full mx-auto rounded-lg"

74 />

75</div>

77### Codex cloud

47 78

48### Prerequisites79### Prerequisites

49 80

57 88

58Start by turning on the ChatGPT GitHub Connector in the Codex section of [Workspace Settings > Settings and Permissions](https://chatgpt.com/admin/settings).89Start by turning on the ChatGPT GitHub Connector in the Codex section of [Workspace Settings > Settings and Permissions](https://chatgpt.com/admin/settings).

59 90

~~60To enable Codex cloud for your workspace, turn on **Allow members to use Codex cloud**.~~91To enable Codex cloud for your workspace, turn on **Allow members to use Codex cloud**. Once enabled, users can access Codex directly from the left-hand navigation panel in ChatGPT.

93Note that it may take up to 10 minutes for Codex to appear in ChatGPT.

95#### Enable Codex Slack app to post answers on task completion

61 96

~~62Once enabled, users can access Codex directly from the left-hand navigation panel in ChatGPT.~~97Codex posts its full answer back to Slack when the task completes. Otherwise, Codex posts only a link to the task.

63 98

~~64![Codex cloud toggle](/images/codex/enterprise/cloud-toggle-config.png)~~99To learn more, see [Codex in Slack](https://developers.openai.com/codex/integrations/slack).

65 100

~~66After you turn on Codex in your Enterprise workspace settings, it may take up~~101#### Enable Codex agent to access the internet

~~67to 10 minutes for Codex to appear in ChatGPT.~~

68 102

~~69### Configure the GitHub Connector IP allow list~~103By default, Codex cloud agents have no internet access during runtime to help protect against security and safety risks like prompt injection.

70 104

~~71To control which IP addresses can connect to your ChatGPT GitHub connector, configure these IP ranges:~~105This setting lets users use an allowlist for common software dependency domains, add domains and trusted sites, and specify allowed HTTP methods.

72 106

~~73- [ChatGPT egress IP ranges](https://openai.com/chatgpt-actions.json)~~107For security implications of internet access and runtime controls, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).

~~74- [Codex container egress IP ranges](https://openai.com/chatgpt-agents.json)~~

75 108

~~76These IP ranges can change. Consider checking them automatically and updating your allow list based on the latest values.~~109<div class="max-w-1xl mx-auto py-1">

110 <img src="https://developers.openai.com/images/codex/enterprise/cloud-toggle-config.png"

111 alt="Codex cloud toggle"

112 class="block w-full mx-auto rounded-lg"

113 />

114</div>

77 115

~~78### Allow members to administer Codex~~116## Step 2: Set up custom roles (RBAC)

79 117

~~80This toggle allows users to view Codex workspace analytics and manage environments (edit and delete).~~118Use RBAC to control granular permissions for access Codex local and Codex cloud.

81 119

~~82Codex supports role-based access (see [Role-based access (RBAC)](#role-based-access-rbac)), so you can turn on this toggle for a specific subset of users.~~120<div class="max-w-1xl mx-auto">

121 <img src="https://developers.openai.com/images/codex/enterprise/rbac_custom_roles.png"

122 alt="Codex cloud toggle"

123 class="block w-full mx-auto rounded-lg"

124 />

125</div>

83 126

~~84### Enable Codex Slack app to post answers on task completion~~127### What RBAC lets you do

85 128

~~86Codex integrates with Slack. When a user mentions `@Codex` in Slack, Codex starts a cloud task, gets context from the Slack thread, and responds with a link to a PR to review in the thread.~~129Workspace Owners can use RBAC in ChatGPT admin settings to:

87 130

88To allow the Slack app to post answers on task completion, turn on **Allow Codex Slack app to post answers on task completion**. When enabled, Codex posts its full answer back to Slack when the task completes. Otherwise, Codex posts only a link to the task.131- Set a default role for users who aren't assigned any custom role

132- Create custom roles with granular permissions

133- Assign one or more custom roles to Groups

134- Automatically sync users into Groups via SCIM

135- Manage roles centrally from the Custom Roles tab

89 136

~~90To learn more, see [Codex in Slack](https://developers.openai.com/codex/integrations/slack).~~137Users can inherit more than one role, and permissions resolve to the most permissive (least restrictive) access across those roles.

91 138

~~92### Enable Codex agent to access the internet~~139### Create a Codex Admin group

93 140

~~94By default, Codex cloud agents have no internet access during runtime to help protect against security and safety risks like prompt injection.~~141Set up a dedicated "Codex Admin" group rather than granting Codex administration to a broad audience.

142

143The **Allow members to administer Codex** toggle grants the Codex Admin role. Codex Admins can:

144

145- View Codex [workspace analytics](https://chatgpt.com/codex/settings/analytics)

146- Open the Codex [Policies page](https://chatgpt.com/codex/settings/policies) to manage cloud-managed `requirements.toml` policies

147- Assign those managed policies to user groups or configure a default fallback policy

148- Manage Codex cloud environments, including editing and deleting environments

149

150Use this role for the small set of admins who own Codex rollout, policy management, and governance. It's not required for general Codex users. You don't need Codex cloud to enable this toggle.

151

152Recommended rollout pattern:

153

154- Create a "Codex Users" group for people who should use Codex

155- Create a separate "Codex Admin" group for the smaller set of people who should manage Codex settings and policies

156- Assign the custom role with **Allow members to administer Codex** enabled only to the "Codex Admin" group

157- Keep membership in the "Codex Admin" group limited to workspace owners or designated platform, IT, and governance operators

158- If you use SCIM, back the "Codex Admin" group with your identity provider so membership changes are auditable and centrally managed

159

160This separation makes it easier to roll out Codex while keeping analytics, environment management, and policy deployment limited to trusted admins. For RBAC setup details and the full permission model, see the [OpenAI RBAC Help Center article](https://help.openai.com/en/articles/11750701-rbac).

161

162## Step 3: Configure Codex local requirements

163

164Codex Admins can deploy admin-enforced `requirements.toml` policies from the Codex [Policies page](https://chatgpt.com/codex/settings/policies).

165

166Use this page when you want to apply different local Codex constraints to different groups without distributing device-level files first. The managed policy uses the same `requirements.toml` format described in [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), so you can define allowed approval policies, sandbox modes, web search behavior, MCP server allowlists, feature pins, and restrictive command rules. To disable Browser Use, the in-app browser, or Computer Use, see [Pin feature flags](https://developers.openai.com/codex/enterprise/managed-configuration#pin-feature-flags).

167

168<div class="max-w-1xl mx-auto py-1">

169 <img src="https://developers.openai.com/images/codex/enterprise/policies_and_configurations_page.png"

170 alt="Codex policies and configurations page"

171 class="block w-full mx-auto rounded-lg"

172 />

173</div>

174

175Recommended setup:

176

1771. Create a baseline policy for most users, then create stricter or more permissive variants only where needed.

1782. Assign each managed policy to a specific user group, and configure a default fallback policy for everyone else.

1793. Order group rules with care. If a user matches more than one group-specific rule, the first matching rule applies.

1804. Treat each policy as a complete profile for that group. Codex doesn't fill missing fields from later matching group rules.

181

182These cloud-managed policies apply across Codex local surfaces when users sign in with ChatGPT, including the Codex app, CLI, and IDE extension.

183

184### Example requirements.toml policies

185

186Use cloud-managed `requirements.toml` policies to enforce the guardrails you want for each group. The snippets below are examples you can adapt, not required settings.

187

188<div class="max-w-1xl mx-auto py-1">

189 <img src="https://developers.openai.com/images/codex/enterprise/example_policy.png"

190 alt="Example managed requirements policy"

191 class="block w-full mx-auto rounded-lg"

192 />

193</div>

194

195Example: limit web search, sandbox mode, and approvals for a standard local rollout:

196

197```toml

198allowed_web_search_modes = ["disabled", "cached"]

199allowed_sandbox_modes = ["workspace-write"]

200allowed_approval_policies = ["on-request"]

201```

202

203Example: disable Browser Use, the in-app browser, and Computer Use:

204

205```toml

206[features]

207browser_use = false

208in_app_browser = false

209computer_use = false

210```

211

212Example: add a restrictive command rule when you want admins to block or gate specific commands:

213

214```toml

215[rules]

216prefix_rules = [

217 { pattern = [{ token = "git" }, { any_of = ["push", "commit"] }], decision = "prompt", justification = "Require review before mutating remote history." },

218]

219```

220

221You can use either example on its own or combine them in a single managed policy for a group. For exact keys, precedence, and more examples, see [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration) and [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).

222

223### Checking user policies

224

225Use the policy lookup tools at the end of the workflow to confirm which managed policy applies to a user. You can check policy assignment by group or by entering a user email.

95 226

~~96As an admin, you can allow users to enable agent internet access in their environments. To enable it, turn on **Allow Codex agent to access the internet**.~~227<div class="max-w-1xl mx-auto py-1">

228 <img src="https://developers.openai.com/images/codex/enterprise/policy_lookup.png"

229 alt="Policy lookup by group or user email"

230 class="block w-full mx-auto rounded-lg"

231 />

232</div>

97 233

~~98When this setting is on, users can use an allow list for common software dependency domains, add more domains and trusted sites, and specify allowed HTTP methods.~~234If you plan to restrict login method or workspace for local clients, see the admin-managed authentication restrictions in [Authentication](https://developers.openai.com/codex/auth).

235

236## Step 4: Standardize local configuration with Team Config

237

238Teams who want to standardize Codex across an organization can use Team Config to share defaults, rules, and skills without duplicating setup on every local configuration.

239

240You can check Team Config settings into the repository under the `.codex` directory. Codex automatically picks up Team Config settings when a user opens that repository.

241

242Start with Team Config for your highest-traffic repositories so teams get consistent behavior in the places they use Codex most.

243

244| Type | Path | Use it to |

245| ------------------------------------ | ------------- | ---------------------------------------------------------------------------- |

246| [Config basics](https://developers.openai.com/codex/config-basic) | `config.toml` | Set defaults for sandbox mode, approvals, model, reasoning effort, and more. |

247| [Rules](https://developers.openai.com/codex/rules) | `rules/` | Control which commands Codex can run outside the sandbox. |

248| [Skills](https://developers.openai.com/codex/skills) | `skills/` | Make shared skills available to your team. |

249

250For locations and precedence, see [Config basics](https://developers.openai.com/codex/config-basic#configuration-precedence).

251

252## Step 5: Configure Codex cloud usage (if enabled)

253

254This step covers repository and environment setup after you enable the Codex cloud workspace toggle.

255

256### Connect Codex cloud to repositories

257

2581. Navigate to [Codex](https://chatgpt.com/codex) and select **Get started**

2592. Select **Connect to GitHub** to install the ChatGPT GitHub Connector if you haven't already connected GitHub to ChatGPT

2603. Install or connect the ChatGPT GitHub Connector

2614. Choose an installation target for the ChatGPT Connector (typically your main organization)

2625. Allow the repositories you want to connect to Codex

263

264For GitHub Enterprise Managed Users (EMU), an organization owner must install

265 the Codex GitHub App for the organization before users can connect

266 repositories in Codex cloud.

267

268For more, see [Cloud environments](https://developers.openai.com/codex/cloud/environments).

269

270Codex uses short-lived, least-privilege GitHub App installation tokens for each operation and respects the user's existing GitHub repository permissions and branch protection rules.

271

272### Configure IP addresses

273

274If your GitHub organization controls the IP addresses that apps use to connect, make sure to include these [egress IP ranges](https://openai.com/chatgpt-agents.json).

275

276These IP ranges can change. Consider checking them automatically and updating your allow list based on the latest values.

99 277

100### Enable code review with Codex cloud278### Enable code review with Codex cloud

101 279

102To allow Codex to do code reviews, go to [Settings → Code review](https://chatgpt.com/codex/settings/code-review).280To allow Codex to perform code reviews on GitHub, go to [Settings → Code review](https://chatgpt.com/codex/settings/code-review).

281

282You can configure code review at the repository level. Users can also enable auto review for their PRs and choose when Codex automatically triggers a review. More details are on the [GitHub integration page](https://developers.openai.com/codex/integrations/github).

283

284Use the overview page to confirm your workspace has code review turned on and to see the available review controls.

285

286<div class="max-w-1xl mx-auto py-1">

287 <img src="https://developers.openai.com/images/codex/enterprise/code_review_settings_overview.png"

288 alt="Code review settings overview"

289 class="block w-full mx-auto rounded-lg"

290 />

291</div>

292

293<div class="grid grid-cols-1 gap-4 py-1 md:grid-cols-2">

294 <div class="max-w-1xl mx-auto">

295 <p>

296 Use the auto review settings to decide whether Codex should review pull

297 requests automatically for connected repositories.

298 </p>

299 <img src="https://developers.openai.com/images/codex/enterprise/auto_code_review_settings.png"

300 alt="Automatic code review settings"

301 class="block w-full mx-auto rounded-lg"

302 />

303 </div>

304 <div class="max-w-1xl mx-auto">

305 <p>

306 Use review triggers to control which pull request events should start a

307 Codex review.

308 </p>

309 <img src="https://developers.openai.com/images/codex/enterprise/review_triggers.png"

310 alt="Code review trigger settings"

311 class="block w-full mx-auto rounded-lg"

312 />

313 </div>

314</div>

315

316### Configure Codex security

317

318Codex Security helps engineering and security teams find, confirm, and remediate likely vulnerabilities in connected GitHub repositories.

319

320At a high level, Codex Security:

321

322- scans connected repositories commit by commit

323- ranks likely findings and confirms them when possible

324- shows structured findings with evidence, criticality, and suggested remediation

325- lets teams refine a repository threat model to improve prioritization and review quality

326

327For setup, scan creation, findings review, and threat model guidance, see [Codex Security setup](https://developers.openai.com/codex/security/setup). For a product overview, see [Codex Security](https://developers.openai.com/codex/security).

328

329Integration docs are also available for [Slack](https://developers.openai.com/codex/integrations/slack), [GitHub](https://developers.openai.com/codex/integrations/github), and [Linear](https://developers.openai.com/codex/integrations/linear).

330

331## Step 6: Set up governance and observability

332

333Codex gives enterprise teams options for visibility into adoption and impact. Set up governance early so your team can track adoption, investigate issues, and support compliance workflows.

334

335### Codex governance typically uses

336

337- Analytics Dashboard for quick, self-serve visibility

338- Analytics API for programmatic reporting and business intelligence integration

339- Compliance API for audit and investigation workflows

340

341### Recommended baseline setup

342

343- Assign an owner for adoption reporting

344- Assign an owner for audit and compliance review

345- Define a review cadence

346- Decide what success looks like

347

348### Analytics API setup steps

349

350To set up the Analytics API key:

351

3521. Sign in to the [OpenAI API Platform Portal](https://platform.openai.com) as an owner or admin, and select the correct organization.

3532. Go to the [API keys page](https://platform.openai.com/settings/organization/api-keys).

3543. Create a new secret key dedicated to Codex Analytics, and give it a descriptive name such as Codex Analytics API.

3554. Select the appropriate project for your organization. If you only have one project, the default project is fine.

3565. Set the key permissions to Read only, since this API only retrieves analytics data.

3576. Copy the key value and store it securely, because you can only view it once.

3587. Email support@openai.com to have that key scoped to `codex.enterprise.analytics.read` only. Wait for OpenAI to confirm your API key has Codex Analytics API access.

359

360<div class="not-prose max-w-md mx-auto py-1">

361 <img src="https://developers.openai.com/images/codex/codex_analytics_key.png"

362 alt="Codex analytics key creation"

363 class="block w-full mx-auto rounded-lg"

364 />

365</div>

366

367To use the Analytics API key:

368

3691. Find your `workspace_id` in the [ChatGPT Admin console](https://chatgpt.com/admin) under Workspace details.

3702. Call the Analytics API at `https://api.chatgpt.com/v1/analytics/codex` using your Platform API key, and include your `workspace_id` in the path.

3713. Choose the endpoint you want to query:

372

373- /workspaces/`{workspace_id}`/usage

374- /workspaces/`{workspace_id}`/code_reviews

375- /workspaces/`{workspace_id}`/code_review_responses

376

3774. Set a reporting date range with `start_time` and `end_time` if needed.

3785. Retrieve the next page of results with `next_page` if the response spans more than one page.

103 379

104Users can specify whether they want Codex to review their pull requests. Users can also configure whether code review runs for all contributors to a repository.380Example curl command to retrieve workspace usage:

105 381

106Codex supports two types of code reviews:382```bash

383curl -H "Authorization: Bearer YOUR_PLATFORM_API_KEY" \

384 "https://api.chatgpt.com/v1/analytics/codex/workspaces/WORKSPACE_ID/usage"

385```

107 386

1081. Automatically triggered code reviews when a user opens a PR for review.387For more details on the Analytics API, see [Analytics API](https://developers.openai.com/codex/enterprise/governance#analytics-api).

1092. Reactive code reviews when a user mentions @Codex to look at issues. For example, “@Codex fix this CI error” or “@Codex address that feedback.”

110 388

111## Role-based access (RBAC)389### Compliance API setup steps

112 390

113Codex supports role-based access. RBAC is a security and permissions model used to control access to systems or resources based on a user’s role assignments.391To set up the Compliance API key:

114 392

115To enable RBAC for Codex, navigate to Settings & Permissions → Custom Roles in [ChatGPT’s admin page](https://chatgpt.com/admin/settings) and assign roles to groups created in the Groups tab.3931. Sign in to the [OpenAI API Platform Portal](https://platform.openai.com) as an owner or admin, and select the correct organization.

3942. Go to the [API keys page](https://platform.openai.com/settings/organization/api-keys).

3953. Create a new secret key dedicated to Compliance API and select the appropriate project for your organization. If you only have one project, the default project is fine.

3964. Choose All permissions.

3975. Copy the key value and store it securely, because you can only view it once.

3986. Send an email to support@openai.com with:

116 399

117This simplifies permission management for Codex and improves security in your ChatGPT workspace. To learn more, see the [Help Center article](https://help.openai.com/en/articles/11750701-rbac).400- the last 4 digits of the API key

401- the key name

402- the created-by name

403- the scope needed: `read`, `delete`, or both

118 404

119## Set up your first Codex cloud environment4057. Wait for OpenAI to confirm your API key has Compliance API access.

120 406

1211. Go to Codex cloud and select **Get started**.407To use the Compliance API key:

1222. Select **Connect to GitHub** to install the ChatGPT GitHub Connector if you haven’t already connected GitHub to ChatGPT.

123 - Allow the ChatGPT Connector for your account.

124 - Choose an installation target for the ChatGPT Connector (typically your main organization).

125 - Allow the repositories you want to connect to Codex (a GitHub admin may need to approve this).

1263. Create your first environment by selecting the repository most relevant to your developers, then select **Create environment**.

127 - Add the email addresses of any environment collaborators to give them edit access.

1284. Start a few starter tasks (for example, writing tests, fixing bugs, or exploring code).

129 408

130You have now created your first environment. Users who connect to GitHub can create tasks using this environment. Users who have access to the repository can also push pull requests generated from their tasks.4091. Find your `workspace_id` in the [ChatGPT Admin console](https://chatgpt.com/admin) under Workspace details.

4102. Use the Compliance API at `https://api.chatgpt.com/v1/`

4113. Pass your Compliance API key in the Authorization header as a Bearer token.

4124. For Codex-related compliance data, use these endpoints:

131 413

132### Environment management414- /compliance/workspaces/`{workspace_id}`/logs

415- /compliance/workspaces/`{workspace_id}`/logs/`{log_file_id}`

416- /compliance/workspaces/`{workspace_id}`/codex_tasks

417- /compliance/workspaces/`{workspace_id}`/codex_environments

133 418

134As a ChatGPT workspace administrator, you can edit and delete Codex environments in your workspace.4195. For most Codex compliance integrations, start with the logs endpoint and request Codex event types such as CODEX_LOG or CODEX_SECURITY_LOG.

4206. Use /logs to list available Codex compliance log files, then /logs/`{log_file_id}` to download a specific file.

135 421

136### Connect more GitHub repositories with Codex cloud422Example curl command to list compliance log files:

137 423

1381. Select **Environments**, or open the environment selector and select **Manage Environments**.424```bash

1392. Select **Create Environment**.425curl -L -H "Authorization: Bearer YOUR_COMPLIANCE_API_KEY" \

1403. Select the repository you want to connect.426 "https://api.chatgpt.com/v1/compliance/workspaces/WORKSPACE_ID/logs?event_type=CODEX_LOG&after=2026-03-01T00:00:00Z"

1414. Enter a name and description.427```

1425. Select the environment visibility.

1436. Select **Create Environment**.

144 428

145Codex automatically optimizes your environment setup by reviewing your codebase. Avoid advanced environment configuration until you observe specific performance issues. For more, see [Codex cloud](https://developers.openai.com/codex/cloud).429Example curl command to list Codex tasks:

146 430

147### Share setup instructions with users431```bash

432curl -H "Authorization: Bearer YOUR_COMPLIANCE_API_KEY" \

433 "https://api.chatgpt.com/v1/compliance/workspaces/WORKSPACE_ID/codex_tasks"

434```

148 435

149You can share these steps with end users:436For more details on the Compliance API, see [Compliance API](https://developers.openai.com/codex/enterprise/governance#compliance-api).

150 437

1511. Go to [Codex](https://chatgpt.com/codex) in the left-hand panel of ChatGPT.438## Step 7: Confirm and verify setup

1522. Select **Connect to GitHub** in the prompt composer if you’re not already connected.

153 - Sign in to GitHub.

1543. You can now use shared environments with your workspace or create your own environment.

1554. Try a task in both Ask and Code mode. For example:

156 - Ask: Find bugs in this codebase.

157 - Write code: Improve test coverage following the existing test patterns.

158 439

159## Track Codex usage440### What to verify

160 441

161- For workspaces with rate limits, use [Settings → Usage](https://chatgpt.com/codex/settings/usage) to view workspace metrics for Codex.442- Users can sign in to Codex local (ChatGPT or API key)

162- For more detail on enterprise governance, refer to the [Governance](https://developers.openai.com/codex/enterprise/governance) page.443- (If enabled) Users can sign in to Codex cloud (ChatGPT sign-in required)

163- For enterprise workspaces with flexible pricing, you can see credit usage in the ChatGPT workspace billing console.444- MFA and SSO requirements match your enterprise security policy

445- RBAC and workspace toggles produce the expected access behavior

446- Managed configuration applies for users

447- Governance data is visible for admins

164 448

165## Zero data retention (ZDR)449For authentication options and enterprise login restrictions, see [Authentication](https://developers.openai.com/codex/auth).

166 450

167Codex supports OpenAI organizations with [Zero Data Retention (ZDR)](https://platform.openai.com/docs/guides/your-data#zero-data-retention) enabled.451Once your team is confident with setup, you can roll Codex out to more teams and organizations.

enterprise/admin-setup.md Codex Docs, 2026-02-19 20:53 UTC → 2026-05-14 21:00 UTC