Fix Codex sign-in that never completes on a remote or headless machine

Option 1: Device code (preferred)

1. Enable device code login in your ChatGPT security settings. If you’re in a workspace, ask your admin to enable it.

2. On the remote machine:

   codex login --device-auth

3. Open the link on any device, sign in, and enter the one-time code.

Option 2: Forward the callback port over SSH

From your local machine:

ssh -L 1455:localhost:1455 user@remote

In that SSH session, run codex login and open the printed address in your local browser.

Option 3: Copy the auth cache

Sign in on a machine with a browser, then copy the cache:

ssh user@remote 'mkdir -p ~/.codex'
scp ~/.codex/auth.json user@remote:~/.codex/auth.json

For Docker:

CONTAINER_HOME=$(docker exec MY_CONTAINER printenv HOME)
docker exec MY_CONTAINER mkdir -p "$CONTAINER_HOME/.codex"
docker cp ~/.codex/auth.json MY_CONTAINER:"$CONTAINER_HOME/.codex/auth.json"

This only works if your local Codex stores credentials in a file. If it uses the OS keyring, set cli_auth_credentials_store = "file" first. Treat auth.json like a password.

For automation

For CI and scripts, OpenAI recommends an API key: printenv OPENAI_API_KEY | codex login --with-api-key.