1. Check where it came from
Write down how you installed Codex. These are the sources OpenAI documents:
| Install method | Where files come from |
|---|---|
install.sh / install.ps1 from chatgpt.com/codex/ | releases.openai.com/codex, falling back to GitHub Releases |
npm install -g @openai/codex | The @openai/codex package on npm |
brew install --cask codex | The Homebrew codex cask |
| Manual binary | github.com/openai/codex/releases |
| Desktop app | chatgpt.com/download, the Microsoft Store, or OpenAI’s Linux packages |
If you can’t place your install in this table, uninstall it and reinstall from one of these sources.
2. Check which binary actually runs
You might have more than one copy installed, for example one from npm and one from Homebrew. See which one your shell runs:
# macOS / Linux
which -a codex# Windows
where.exe codexThe path should match your install method. For example, a Homebrew path for brew, or your npm global prefix for npm.
3. Check the version
codex --versionCompare it with the latest release on GitHub or with our release tracker. Being a release or two behind is normal. A version that doesn’t exist on GitHub at all is a red flag.
For the copy bundled inside the macOS desktop app, OpenAI’s troubleshooting page gives this path:
/Applications/Codex.app/Contents/Resources/codex --version4. Check where sign-in goes
When you sign in, Codex opens your browser to ChatGPT. If a “Codex” program asks you to type your OpenAI password into its own window, or asks for your API key in a web form that isn’t on platform.openai.com, stop. Treat your ~/.codex/auth.json file like a password. It contains access tokens.
What about checksums?
GitHub Releases for openai/codex list the assets for each version. If you download a binary by hand, take it only from that page and over HTTPS. We’ll add a step-by-step checksum walkthrough here once we’ve tested it end to end. We won’t publish hashes ourselves, because a copied hash is only as trustworthy as the page it’s copied from.