ChatGPT sign-in vs API key
| Sign in with ChatGPT | Sign in with an API key | |
|---|---|---|
| Billing | Included in your ChatGPT plan | Standard OpenAI API rates |
| Codex cloud | Supported | Not supported |
| Some workspace and cloud features | Available | Limited or unavailable |
| Good for | Everyday interactive use | Scripts, CI/CD, usage-based billing |
CLI commands
codex login # browser sign-in with ChatGPT
printenv OPENAI_API_KEY | codex login --with-api-key
codex login --device-auth # headless / SSH (beta)
codex login status # which method is active
codex logoutIn the desktop app, choose Continue to sign in, or Sign in another way for an API key. In the IDE extension, choose Sign in with ChatGPT or Use API Key.
Signing in on a server or over SSH
The browser flow needs a callback to localhost:1455, which doesn’t work on a headless machine. In order of preference:
- Device code. Enable device code login in your ChatGPT security settings, or ask your workspace admin. Then run
codex login --device-auth, open the link, and enter the code. - Forward the callback port. Run
ssh -L 1455:localhost:1455 user@remote, then runcodex loginin that session. - Copy the auth cache. Sign in on a machine with a browser, then copy
~/.codex/auth.jsonto the same path on the server. This only works if Codex uses file storage for credentials.
Keep your credentials safe
Codex caches login details in ~/.codex/auth.json or in your OS credential store. Choose where with cli_auth_credentials_store in config.toml:
# file | keyring | auto | ephemeral
cli_auth_credentials_store = "keyring"Never commit auth.json, paste it into a ticket, or share it in chat. It contains access tokens.