enterprise/admin-setup.md Codex Docs, 2026-04-18 18:18 UTC → 2026-05-14 21:00 UTC

1# Admin Setup1# Admin Setup

2 2 

3![Codex enterprise admin toggle](/images/codex/codex_enterprise_admin.png)3<div class="max-w-1xl mx-auto">

4 <img src="https://developers.openai.com/images/codex/codex_enterprise_admin.png"

5 alt="Codex enterprise admin toggle"

6 class="block w-full mx-auto rounded-lg"

7 />

8</div>

9 

10 

4 11 

5This guide is for ChatGPT Enterprise admins who want to set up Codex for their workspace.12This guide is for ChatGPT Enterprise admins who want to set up Codex for their workspace.

6 13 

7Use this page as the step-by-step rollout guide. For detailed policy, configuration, and monitoring details, use the linked pages: [Authentication](https://developers.openai.com/codex/auth), [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security), [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), and [Governance](https://developers.openai.com/codex/enterprise/governance).14Use this page as the step-by-step rollout guide. For detailed policy, configuration, automation, and monitoring details, use the linked pages: [Authentication](https://developers.openai.com/codex/auth), [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security), [Access tokens](https://developers.openai.com/codex/enterprise/access-tokens), [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), and [Governance](https://developers.openai.com/codex/enterprise/governance).

8 15 

9## Enterprise-grade security and privacy16## Enterprise-grade security and privacy

10 17 

52 59 

53This enables use of the Codex app, CLI, and IDE extension for allowed users.60This enables use of the Codex app, CLI, and IDE extension for allowed users.

54 61 

55If this toggle is off, users who attempt to use the Codex app, CLI, or IDE will see the following error: “403 - Unauthorized. Contact your ChatGPT administrator for access.”62If members need programmatic Codex local workflows, also turn on **Allow members to use Codex access tokens** or grant the access token permission through a custom role. For setup and permission details, see [Access tokens](https://developers.openai.com/codex/enterprise/access-tokens).

63 

64If the Codex Local toggle is off, users who attempt to use the Codex app, CLI, or IDE will see the following error: “403 - Unauthorized. Contact your ChatGPT administrator for access.”

56 65 

57#### Enable device code authentication for Codex CLI66#### Enable device code authentication for Codex CLI

58 67 

59Allow developers to sign in with a device code when using Codex CLI in a non-interactive environment (for example, a remote development box). More details are in [authentication](https://developers.openai.com/codex/auth/).68Allow developers to sign in with a device code when using Codex CLI in a non-interactive environment (for example, a remote development box). More details are in [authentication](https://developers.openai.com/codex/auth/).

60 69 

61![Codex local toggle](/images/codex/enterprise/local-toggle-config.png)70<div class="max-w-1xl mx-auto py-1">

71 <img src="https://developers.openai.com/images/codex/enterprise/local-toggle-config.png"

72 alt="Codex local toggle"

73 class="block w-full mx-auto rounded-lg"

74 />

75</div>

62 76 

63### Codex cloud77### Codex cloud

64 78 

92 106 

93For security implications of internet access and runtime controls, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).107For security implications of internet access and runtime controls, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).

94 108 

95![Codex cloud toggle](/images/codex/enterprise/cloud-toggle-config.png)109<div class="max-w-1xl mx-auto py-1">

110 <img src="https://developers.openai.com/images/codex/enterprise/cloud-toggle-config.png"

111 alt="Codex cloud toggle"

112 class="block w-full mx-auto rounded-lg"

113 />

114</div>

96 115 

97## Step 2: Set up custom roles (RBAC)116## Step 2: Set up custom roles (RBAC)

98 117 

99Use RBAC to control granular permissions for access Codex local and Codex cloud.118Use RBAC to control granular permissions for access Codex local and Codex cloud.

100 119 

101![Codex cloud toggle](/images/codex/enterprise/rbac_custom_roles.png)120<div class="max-w-1xl mx-auto">

121 <img src="https://developers.openai.com/images/codex/enterprise/rbac_custom_roles.png"

122 alt="Codex cloud toggle"

123 class="block w-full mx-auto rounded-lg"

124 />

125</div>

102 126 

103### What RBAC lets you do127### What RBAC lets you do

104 128 

139 163 

140Codex Admins can deploy admin-enforced `requirements.toml` policies from the Codex [Policies page](https://chatgpt.com/codex/settings/policies).164Codex Admins can deploy admin-enforced `requirements.toml` policies from the Codex [Policies page](https://chatgpt.com/codex/settings/policies).

141 165 

142Use this page when you want to apply different local Codex constraints to different groups without distributing device-level files first. The managed policy uses the same `requirements.toml` format described in [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), so you can define allowed approval policies, sandbox modes, web search behavior, MCP server allowlists, feature pins, and restrictive command rules.166Use this page when you want to apply different local Codex constraints to different groups without distributing device-level files first. The managed policy uses the same `requirements.toml` format described in [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), so you can define allowed approval policies, sandbox modes, web search behavior, MCP server allowlists, feature pins, and restrictive command rules. To disable Browser Use, the in-app browser, or Computer Use, see [Pin feature flags](https://developers.openai.com/codex/enterprise/managed-configuration#pin-feature-flags).

143 167 

144![Codex policies and configurations page](/images/codex/enterprise/policies_and_configurations_page.png)168<div class="max-w-1xl mx-auto py-1">

169 <img src="https://developers.openai.com/images/codex/enterprise/policies_and_configurations_page.png"

170 alt="Codex policies and configurations page"

171 class="block w-full mx-auto rounded-lg"

172 />

173</div>

145 174 

146Recommended setup:175Recommended setup:

147 176 

156 185 

157Use cloud-managed `requirements.toml` policies to enforce the guardrails you want for each group. The snippets below are examples you can adapt, not required settings.186Use cloud-managed `requirements.toml` policies to enforce the guardrails you want for each group. The snippets below are examples you can adapt, not required settings.

158 187 

159![Example managed requirements policy](/images/codex/enterprise/example_policy.png)188<div class="max-w-1xl mx-auto py-1">

189 <img src="https://developers.openai.com/images/codex/enterprise/example_policy.png"

190 alt="Example managed requirements policy"

191 class="block w-full mx-auto rounded-lg"

192 />

193</div>

160 194 

161Example: limit web search, sandbox mode, and approvals for a standard local rollout:195Example: limit web search, sandbox mode, and approvals for a standard local rollout:

162 196 

166allowed_approval_policies = ["on-request"]200allowed_approval_policies = ["on-request"]

167```201```

168 202 

203Example: disable Browser Use, the in-app browser, and Computer Use:

204 

205```toml

206[features]

207browser_use = false

208in_app_browser = false

209computer_use = false

210```

211 

169Example: add a restrictive command rule when you want admins to block or gate specific commands:212Example: add a restrictive command rule when you want admins to block or gate specific commands:

170 213 

171```toml214```toml

181 224 

182Use the policy lookup tools at the end of the workflow to confirm which managed policy applies to a user. You can check policy assignment by group or by entering a user email.225Use the policy lookup tools at the end of the workflow to confirm which managed policy applies to a user. You can check policy assignment by group or by entering a user email.

183 226 

184![Policy lookup by group or user email](/images/codex/enterprise/policy_lookup.png)227<div class="max-w-1xl mx-auto py-1">

228 <img src="https://developers.openai.com/images/codex/enterprise/policy_lookup.png"

229 alt="Policy lookup by group or user email"

230 class="block w-full mx-auto rounded-lg"

231 />

232</div>

185 233 

186If you plan to restrict login method or workspace for local clients, see the admin-managed authentication restrictions in [Authentication](https://developers.openai.com/codex/auth).234If you plan to restrict login method or workspace for local clients, see the admin-managed authentication restrictions in [Authentication](https://developers.openai.com/codex/auth).

187 235 

235 283 

236Use the overview page to confirm your workspace has code review turned on and to see the available review controls.284Use the overview page to confirm your workspace has code review turned on and to see the available review controls.

237 285 

238![Code review settings overview](/images/codex/enterprise/code_review_settings_overview.png)286<div class="max-w-1xl mx-auto py-1">

287 <img src="https://developers.openai.com/images/codex/enterprise/code_review_settings_overview.png"

288 alt="Code review settings overview"

289 class="block w-full mx-auto rounded-lg"

290 />

291</div>

239 292 

293<div class="grid grid-cols-1 gap-4 py-1 md:grid-cols-2">

294 <div class="max-w-1xl mx-auto">

295 <p>

240 Use the auto review settings to decide whether Codex should review pull296 Use the auto review settings to decide whether Codex should review pull

241 requests automatically for connected repositories.297 requests automatically for connected repositories.

242 298 </p>

243![Automatic code review settings](/images/codex/enterprise/auto_code_review_settings.png)299 <img src="https://developers.openai.com/images/codex/enterprise/auto_code_review_settings.png"

244 300 alt="Automatic code review settings"

301 class="block w-full mx-auto rounded-lg"

302 />

303 </div>

304 <div class="max-w-1xl mx-auto">

305 <p>

245 Use review triggers to control which pull request events should start a306 Use review triggers to control which pull request events should start a

246 Codex review.307 Codex review.

247 308 </p>

248![Code review trigger settings](/images/codex/enterprise/review_triggers.png)309 <img src="https://developers.openai.com/images/codex/enterprise/review_triggers.png"

310 alt="Code review trigger settings"

311 class="block w-full mx-auto rounded-lg"

312 />

313 </div>

314</div>

249 315 

250### Configure Codex security316### Configure Codex security

251 317 

2894. Select the appropriate project for your organization. If you only have one project, the default project is fine.3554. Select the appropriate project for your organization. If you only have one project, the default project is fine.

2905. Set the key permissions to Read only, since this API only retrieves analytics data.3565. Set the key permissions to Read only, since this API only retrieves analytics data.

2916. Copy the key value and store it securely, because you can only view it once.3576. Copy the key value and store it securely, because you can only view it once.

2927. Email [support@openai.com](mailto:support@openai.com) to have that key scoped to `codex.enterprise.analytics.read` only. Wait for OpenAI to confirm your API key has Codex Analytics API access.3587. Email support@openai.com to have that key scoped to `codex.enterprise.analytics.read` only. Wait for OpenAI to confirm your API key has Codex Analytics API access.

293 359 

294![Codex analytics key creation](/images/codex/codex_analytics_key.png)360<div class="not-prose max-w-md mx-auto py-1">

361 <img src="https://developers.openai.com/images/codex/codex_analytics_key.png"

362 alt="Codex analytics key creation"

363 class="block w-full mx-auto rounded-lg"

364 />

365</div>

295 366 

296To use the Analytics API key:367To use the Analytics API key:

297 368 

3243. Create a new secret key dedicated to Compliance API and select the appropriate project for your organization. If you only have one project, the default project is fine.3953. Create a new secret key dedicated to Compliance API and select the appropriate project for your organization. If you only have one project, the default project is fine.

3254. Choose All permissions.3964. Choose All permissions.

3265. Copy the key value and store it securely, because you can only view it once.3975. Copy the key value and store it securely, because you can only view it once.

3276. Send an email to [support@openai.com](mailto:support@openai.com) with:3986. Send an email to support@openai.com with:

328 399 

329- the last 4 digits of the API key400- the last 4 digits of the API key

330- the key name401- the key name