Codex

Use authsome from OpenAI’s Codex CLI. Run agents under the auth proxy so credentials never enter the agent’s environment.

OpenAI’s Codex CLI is a coding agent that runs locally and shells out to other tools. Authsome plugs in cleanly: wrap the agent invocation with authsome run -- and the proxy injects fresh credentials for every service the agent calls.

The agent drives login. When Codex hits a missing credential it runs authsome login <provider> itself, opens a browser on your machine for OAuth consent, and picks up from there. Don’t paste keys into prompts and don’t pre-run login commands unless you’re seeding a credential ahead of time.

Run Codex under the auth proxy. Paste this to set up the wrapper.

CopiedCopy prompt

What you get

• One login per service. Codex never sees raw client_secrets, tokens, or API keys.
• Automatic refresh. OAuth tokens stay fresh between Codex sessions.
• Multi-account support. Run Codex against your work GitHub one minute, personal the next.
• The same vault. Connections created from Codex live alongside connections from the regular CLI.

Recommended pattern: run Codex under the proxy

authsome login github
authsome login openai
authsome run -- codex

Inside Codex:

• OPENAI_API_KEY=authsome-proxy-managed is set in Codex’s environment, so its SDK initializes.
• Outbound HTTPS calls to api.openai.com, api.github.com, and any other matched provider are intercepted and authenticated at the proxy layer.
• Codex’s own subprocess calls inherit the same HTTP_PROXY / HTTPS_PROXY variables, so tools Codex spawns are also covered.

Alternative: env export before launch

If Codex is running in an environment where the proxy CA cannot be trusted, fall back to env-var export:

eval "$(authsome export openai --format env)"
eval "$(authsome export github --format env)"
codex

The variables persist for the shell session. Codex (and anything it spawns) reads them as it normally would. Re-run eval after token refresh, or use the proxy pattern above to avoid that step.

Multiple accounts

authsome login github --connection personal
authsome login github --connection work
authsome login github --connection work --force   # switch default to work
authsome run -- codex

The proxy uses each provider’s default connection. To target a non-default connection in a single Codex session, set it as the default with --force first. See Multiple connections per provider.

Embedding the library

If you’re orchestrating Codex from a larger Python program and need explicit per-call control, drop below the proxy into the library:

authsome run -- python my_agent.py
# or: eval "$(authsome export <provider> --format env)"

This pattern is cleaner than passing keys through prompts or hardcoding them into .env files. See Python library.

Troubleshooting

Symptom	Fix
Codex starts but every API call fails with TLS errors	The mitmproxy CA isn’t trusted. See Proxy networking.
Codex doesn’t see the env var even though authsome run set it	Verify with authsome run -- env | grep OPENAI.
Authsome login hangs	authsome doctor and check port 7998 availability.

What’s next

Run agents with the proxy

The injection model in detail.

OpenAI integration

Set up the OpenAI key Codex will use.