Key takeaways:

• Codex CLI is a coding assistant that runs in the terminal and can understand and execute your repositories.
• It supports multiple models, including OpenAI, Azure, OpenRouter, etc., and can be flexibly configured through configuration files.
• Codex CLI offers different permission modes, can run automatically in a secure and reliable environment, and has detailed logging and debugging features.

OpenAI Codex CLI: Lightweight coding agent that runs in your terminal

Quickstart

Install globally:

1

npm install -g @openai/codex

Next, set your OpenAI API key as an environment variable:

1

export OPENAI_API_KEY="your-api-key-here"

Note: This command sets the key only for your current terminal session. You can add the export line to your shell’s configuration file (e.g., ~/.zshrc) but we recommend setting for the session. Tip: You can also place your API key into a .env file at the root of your project:

1	OPENAI_API_KEY=your-api-key-here

The CLI will automatically load variables from .env (via dotenv/config).

Run interactively:

1

codex

Or, run with a prompt as input (and optionally in Full Auto mode):

1

codex "explain this codebase to me"

1

codex --approval-mode full-auto "create the fanciest todo-list app"

That’s it - Codex will scaffold a file, run it inside a sandbox, install any missing dependencies, and show you the live result. Approve the changes and they’ll be committed to your working directory.

Why Codex?

Codex CLI is built for developers who already live in the terminal and want ChatGPT-level reasoning plus the power to actually run code, manipulate files, and iterate - all under version control. In short, it’s chat-driven development that understands and executes your repo.

• Zero setup - bring your OpenAI API key and it just works!
• Full auto-approval, while safe + secure by running network-disabled and directory-sandboxed
• Multimodal - pass in screenshots or diagrams to implement features ✨

And it’s fully open-source so you can see and contribute to how it develops!

Security model & permissions

Codex lets you decide how much autonomy the agent receives and auto-approval policy via the --approval-mode flag (or the interactive onboarding prompt):

In Full Auto every command is run network-disabled and confined to the current working directory (plus temporary files) for defense-in-depth. Codex will also show a warning/confirmation if you start in auto-edit or full-auto while the directory is not tracked by Git, so you always have a safety net.

Coming soon: you’ll be able to whitelist specific commands to auto-execute with the network enabled, once we’re confident in additional safeguards.

Platform sandboxing details

The hardening mechanism Codex uses depends on your OS:

• macOS 12+ - commands are wrapped with Apple Seatbelt (sandbox-exec).

  • Everything is placed in a read-only jail except for a small set of writable roots ($PWD, $TMPDIR, ~/.codex, etc.).
  • Outbound network is fully blocked by default - even if a child process tries to curl somewhere it will fail.

• Linux - there is no sandboxing by default. We recommend using Docker for sandboxing, where Codex launches itself inside a minimal container image and mounts your repo read/write at the same path. A custom iptables/ipset firewall script denies all egress except the OpenAI API. This gives you deterministic, reproducible runs without needing root on the host. You can use the run_in_container.sh script to set up the sandbox.

System requirements

Never run sudo npm install -g; fix npm permissions instead.

CLI reference

Key flags: --model/-m, --approval-mode/-a, --quiet/-q, and --notify.

Memory & project docs

You can give Codex extra instructions and guidance using AGENTS.md files. Codex looks for AGENTS.md files in the following places, and merges them top-down:

1. ~/.codex/AGENTS.md - personal global guidance
2. AGENTS.md at repo root - shared project notes
3. AGENTS.md in the current working directory - sub-folder/feature specifics

Disable loading of these files with --no-project-doc or the environment variable CODEX_DISABLE_PROJECT_DOC=1.

Non-interactive / CI mode

Run Codex head-less in pipelines. Example GitHub Action step:

1
2
3
4
5

- name: Update changelog via Codex
  run: |
    npm install -g @openai/codex
    export OPENAI_API_KEY="${{ secrets.OPENAI_KEY }}"
    codex -a auto-edit --quiet "update CHANGELOG for next release"

Set CODEX_QUIET_MODE=1 to silence interactive UI noise.

Tracing / verbose logging

Setting the environment variable DEBUG=true prints full API request and response details:

1

DEBUG=true codex

Recipes

Below are a few bite-size examples you can copy-paste. Replace the text in quotes with your own task. See the prompting guide for more tips and usage patterns.

Installation

1
2
3
4
5
6
7

npm install -g @openai/codex
# or
yarn global add @openai/codex
# or
bun install -g @openai/codex
# or
pnpm add -g @openai/codex

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# Clone the repository and navigate to the CLI package
git clone https://github.com/openai/codex.git
cd codex/codex-cli

# Enable corepack
corepack enable

# Install dependencies and build
pnpm install
pnpm build

# Linux-only: download prebuilt sandboxing binaries (requires gh and zstd).
./scripts/install_native_deps.sh

# Get the usage and the options
node ./dist/cli.js --help

# Run the locally-built CLI directly
node ./dist/cli.js

# Or link the command globally for convenience
pnpm link

Configuration guide

Codex configuration files can be placed in the ~/.codex/ directory, supporting both YAML and JSON formats.

Basic configuration parameters

Custom AI provider configuration

In the providers object, you can configure multiple AI service providers. Each provider requires the following parameters:

History configuration

In the history object, you can configure conversation history settings:

Configuration examples

1. YAML format (save as ~/.codex/config.yaml):

1
2
3
4

model: o4-mini
approvalMode: suggest
fullAutoErrorMode: ask-user
notify: true

2. JSON format (save as ~/.codex/config.json):

1
2
3
4
5
6

{
  "model": "o4-mini",
  "approvalMode": "suggest",
  "fullAutoErrorMode": "ask-user",
  "notify": true
}

Full configuration example

Below is a comprehensive example of config.json with multiple custom providers:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

{
  "model": "o4-mini",
  "provider": "openai",
  "providers": {
    "openai": {
      "name": "OpenAI",
      "baseURL": "https://api.openai.com/v1",
      "envKey": "OPENAI_API_KEY"
    },
    "azure": {
      "name": "AzureOpenAI",
      "baseURL": "https://YOUR_PROJECT_NAME.openai.azure.com/openai",
      "envKey": "AZURE_OPENAI_API_KEY"
    },
    "openrouter": {
      "name": "OpenRouter",
      "baseURL": "https://openrouter.ai/api/v1",
      "envKey": "OPENROUTER_API_KEY"
    },
    "gemini": {
      "name": "Gemini",
      "baseURL": "https://generativelanguage.googleapis.com/v1beta/openai",
      "envKey": "GEMINI_API_KEY"
    },
    "ollama": {
      "name": "Ollama",
      "baseURL": "http://localhost:11434/v1",
      "envKey": "OLLAMA_API_KEY"
    },
    "mistral": {
      "name": "Mistral",
      "baseURL": "https://api.mistral.ai/v1",
      "envKey": "MISTRAL_API_KEY"
    },
    "deepseek": {
      "name": "DeepSeek",
      "baseURL": "https://api.deepseek.com",
      "envKey": "DEEPSEEK_API_KEY"
    },
    "xai": {
      "name": "xAI",
      "baseURL": "https://api.x.ai/v1",
      "envKey": "XAI_API_KEY"
    },
    "groq": {
      "name": "Groq",
      "baseURL": "https://api.groq.com/openai/v1",
      "envKey": "GROQ_API_KEY"
    },
    "arceeai": {
      "name": "ArceeAI",
      "baseURL": "https://conductor.arcee.ai/v1",
      "envKey": "ARCEEAI_API_KEY"
    }
  },
  "history": {
    "maxSize": 1000,
    "saveHistory": true,
    "sensitivePatterns": []
  }
}

Custom instructions

You can create a ~/.codex/AGENTS.md file to define custom guidance for the agent:

1
2

- Always respond with emojis
- Only use git commands when explicitly requested

Environment variables setup

For each AI provider, you need to set the corresponding API key in your environment variables. For example:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# OpenAI
export OPENAI_API_KEY="your-api-key-here"

# Azure OpenAI
export AZURE_OPENAI_API_KEY="your-azure-api-key-here"
export AZURE_OPENAI_API_VERSION="2025-03-01-preview" (Optional)

# OpenRouter
export OPENROUTER_API_KEY="your-openrouter-key-here"

# Similarly for other providers

FAQ

Zero data retention (ZDR) usage

Codex CLI does support OpenAI organizations with Zero Data Retention (ZDR) enabled. If your OpenAI organization has Zero Data Retention enabled and you still encounter errors such as:

1

OpenAI rejected the request. Error details: Status: 400, Code: unsupported_parameter, Type: invalid_request_error, Message: 400 Previous response cannot be used for this organization due to Zero Data Retention.

You may need to upgrade to a more recent version with: npm i -g @openai/codex@latest

Codex open source fund

We’re excited to launch a $1 million initiative supporting open source projects that use Codex CLI and other OpenAI models.

• Grants are awarded up to $25,000 API credits.
• Applications are reviewed on a rolling basis.

Interested? Apply here.

Contributing

This project is under active development and the code will likely change pretty significantly. We’ll update this message once that’s complete!

More broadly we welcome contributions - whether you are opening your very first pull request or you’re a seasoned maintainer. At the same time we care about reliability and long-term maintainability, so the bar for merging code is intentionally high. The guidelines below spell out what “high-quality” means in practice and should make the whole process transparent and friendly.

Development workflow

• Create a topic branch from main - e.g. feat/interactive-prompt.
• Keep your changes focused. Multiple unrelated fixes should be opened as separate PRs.
• Use pnpm test:watch during development for super-fast feedback.
• We use Vitest for unit tests, ESLint + Prettier for style, and TypeScript for type-checking.
• Before pushing, run the full test/type/lint suite:

Git hooks with Husky

This project uses Husky to enforce code quality checks:

• Pre-commit hook: Automatically runs lint-staged to format and lint files before committing
• Pre-push hook: Runs tests and type checking before pushing to the remote

These hooks help maintain code quality and prevent pushing code with failing tests. For more details, see HUSKY.md.

1

pnpm test && pnpm run lint && pnpm run typecheck

• If you have not yet signed the Contributor License Agreement (CLA), add a PR comment containing the exact text

  1	I have read the CLA Document and I hereby sign the CLA

  The CLA-Assistant bot will turn the PR status green once all authors have signed.

1
2
3
4
5
6
7
8
9

# Watch mode (tests rerun on change)
pnpm test:watch

# Type-check without emitting files
pnpm typecheck

# Automatically fix lint + prettier issues
pnpm lint:fix
pnpm format:fix

Debugging

To debug the CLI with a visual debugger, do the following in the codex-cli folder:

• Run pnpm run build to build the CLI, which will generate cli.js.map alongside cli.js in the dist folder.
• Run the CLI with node --inspect-brk ./dist/cli.js The program then waits until a debugger is attached before proceeding. Options:
  • In VS Code, choose Debug: Attach to Node Process from the command palette and choose the option in the dropdown with debug port 9229 (likely the first option)
  • Go to chrome://inspect in Chrome and find localhost:9229 and click trace

Writing high-impact code changes

1. Start with an issue. Open a new one or comment on an existing discussion so we can agree on the solution before code is written.
2. Add or update tests. Every new feature or bug-fix should come with test coverage that fails before your change and passes afterwards. 100% coverage is not required, but aim for meaningful assertions.
3. Document behaviour. If your change affects user-facing behaviour, update the README, inline help (codex --help), or relevant example projects.
4. Keep commits atomic. Each commit should compile and the tests should pass. This makes reviews and potential rollbacks easier.

Opening a pull request

• Fill in the PR template (or include similar information) - What? Why? How?
• Run all checks locally (npm test && npm run lint && npm run typecheck). CI failures that could have been caught locally slow down the process.
• Make sure your branch is up-to-date with main and that you have resolved merge conflicts.
• Mark the PR as Ready for review only when you believe it is in a merge-able state.

Review process

1. One maintainer will be assigned as a primary reviewer.
2. We may ask for changes - please do not take this personally. We value the work, we just also value consistency and long-term maintainability.
3. When there is consensus that the PR meets the bar, a maintainer will squash-and-merge.

Community values

• Be kind and inclusive. Treat others with respect; we follow the Contributor Covenant.
• Assume good intent. Written communication is hard - err on the side of generosity.
• Teach & learn. If you spot something confusing, open an issue or PR with improvements.

Getting help

If you run into problems setting up the project, would like feedback on an idea, or just want to say hi - please open a Discussion or jump into the relevant issue. We are happy to help.

Together we can make Codex CLI an incredible tool. Happy hacking! :rocket:

Contributor license agreement (CLA)

All contributors must accept the CLA. The process is lightweight:

1. Open your pull request.

2. Paste the following comment (or reply recheck if you’ve signed before):

   1	I have read the CLA Document and I hereby sign the CLA

3. The CLA-Assistant bot records your signature in the repo and marks the status check as passed.

No special Git commands, email attachments, or commit footers required.

Quick fixes

The DCO check blocks merges until every commit in the PR carries the footer (with squash this is just the one).

Releasing codex

To publish a new version of the CLI you first need to stage the npm package. A helper script in codex-cli/scripts/ does all the heavy lifting. Inside the codex-cli folder run:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Classic, JS implementation that includes small, native binaries for Linux sandboxing.
pnpm stage-release

# Optionally specify the temp directory to reuse between runs.
RELEASE_DIR=$(mktemp -d)
pnpm stage-release --tmp "$RELEASE_DIR"

# "Fat" package that additionally bundles the native Rust CLI binaries for
# Linux. End-users can then opt-in at runtime by setting CODEX_RUST=1.
pnpm stage-release --native

Go to the folder where the release is staged and verify that it works as intended. If so, run the following from the temp folder:

1
2

cd "$RELEASE_DIR"
npm publish

Alternative build options

Nix flake development

Prerequisite: Nix >= 2.4 with flakes enabled (experimental-features = nix-command flakes in ~/.config/nix/nix.conf).

Enter a Nix development shell:

1
2
3

# Use either one of the commands according to which implementation you want to work with
nix develop .#codex-cli # For entering codex-cli specific shell
nix develop .#codex-rs # For entering codex-rs specific shell

This shell includes Node.js, installs dependencies, builds the CLI, and provides a codex command alias.

Build and run the CLI directly:

1
2
3
4

# Use either one of the commands according to which implementation you want to work with
nix build .#codex-cli # For building codex-cli
nix build .#codex-rs # For building codex-rs
./result/bin/codex --help

Run the CLI via the flake app:

1
2
3

# Use either one of the commands according to which implementation you want to work with
nix run .#codex-cli # For running codex-cli
nix run .#codex-rs # For running codex-rs

Use direnv with flakes

If you have direnv installed, you can use the following .envrc to automatically enter the Nix shell when you cd into the project directory:

1
2
3
4

cd codex-rs
echo "use flake ../flake.nix#codex-cli" >> .envrc && direnv allow
cd codex-cli
echo "use flake ../flake.nix#codex-rs" >> .envrc && direnv allow