GPT WORLD / INDEPENDENT CODEX FIELD MANUAL Source review · 2026-07-26
GPT World
Open navigation
EN 中 日

Field guide / 11 min

Choose authentication without leaking credentials

ChatGPT sign-in, API-key access, and headless login have different boundaries.

Track
Codex CLI core
Level
Foundation
Maturity
Stable

Codex supports ChatGPT sign-in for subscription access and API-key sign-in for usage-based local work. The safe path is to choose the flow deliberately, pipe secrets through stdin, verify the active method, and treat local auth storage like a password.

CLI

Verified terminal sequence

TERMINAL / COPY WITH INTENT
  1. $codex login
  2. $codex login status
  3. $codex login --device-auth
  4. $printenv OPENAI_API_KEY | codex login --with-api-key
  5. $codex logout
A

Working principles

01

Authentication selects policy

ChatGPT login follows workspace controls; API-key login follows the API organization. It is not merely a different button.

02

Secrets travel through stdin

Do not paste an API key into a command argument, shell history, ticket, or repository file.

03

Local auth is sensitive

File-based auth.json can contain access tokens. Prefer the OS keyring when appropriate and never commit the file.

B

Field procedure

  1. 01

    Choose ChatGPT or API access

    Use browser login for subscription-backed local work; use an API key when usage-based local or programmatic access is the intended boundary.

  2. 02

    Complete the flow

    Run codex login, or pipe OPENAI_API_KEY to --with-api-key. On a headless host, try the documented device-auth flow.

  3. 03

    Verify the active method

    Run codex login status before beginning sensitive work or switching workspaces.

  4. 04

    Protect credential storage

    Keep CODEX_HOME and auth storage out of source control, backups shared with others, and troubleshooting bundles.

  5. 05

    End shared-machine sessions

    Run codex logout when the machine or shell profile will pass to another user.

PASS / FAIL

Acceptance checklist

  • codex login status shows the intended method.
  • The correct workspace or API organization is active.
  • API keys never appear in shell history.
  • auth.json is excluded from source control and sharing.

WATCH / REJECT

Failure patterns

  • Assuming API-key login includes every cloud feature.
  • Setting credentials job-wide around untrusted repository code.
  • Copying auth.json between people.