Authenticate Codex with ChatGPT sign-in or an API key

A running codex session needs credentials before it can call a model. Codex supports interactive ChatGPT sign-in and API-key sign-in. Pick the path that matches how you work today; you can switch later, but the path affects automation and sometimes which model tiers are available.

The two paths

The default browser flow:

> codex login

That opens a browser, you authorize against your ChatGPT account, and you return to the terminal signed in. No key to copy for day-to-day interactive use at your desk.

For programmatic or CI use, authenticate with an API key in the environment:

printenv OPENAI_API_KEY | codex login --with-api-key

In the CLI, the command you run is the choice - there is no separate picker screen. (Desktop and IDE surfaces may show a sign-in chooser when logged out.) Supported flows and troubleshooting live in the authentication docs.

Why the choice matters

Capabilities can depend on how you signed in. Reasoning and model options are not always identical across ChatGPT sign-in and API-key sign-in - which of your account’s models each path exposes varies by plan and over time, so treat the authentication docs as the list of record for your account rather than assuming both paths see the same catalog (the models chapter returns to this when picking models). You do not need to optimize that on lesson one; file it away before the models-and-effort chapter.

Automation favors the API key, but ChatGPT sign-in is not locked out of headless use. Unattended jobs usually want OPENAI_API_KEY in secrets - no browser, no click-through. ChatGPT sign-in can still support other flows (cached credentials, device auth where documented). For this chapter, ChatGPT sign-in is fine for interactive fixing in budgetcli (the small Python teaching repo this chapter’s intro describes).

Sign-in does not set how much the agent may edit or which commands it may run. Sandboxing and approvals are separate; the approvals and sandbox chapter is where control is configured on purpose.

For the exercises here, codex login is the lowest-friction default. Keep the API-key pipeline in mind for CI and scheduled runs.

Before moving on, confirm which way you are signed in: codex login status prints the current login state (verified against Codex CLI 0.155.1). With credentials confirmed, learn the shape of one turn before you ask for writes - the loop.