Codex CLI Login: ChatGPT Sign-In vs API Key (2026) — Commands, Feature Gaps, and the Plaintext Credential Fix

The first thing Codex CLI asks you is which way you want to sign in: with your ChatGPT account, or with an API key. Pick without thinking and you find out later either that GitHub code review is missing, or that your API bill is no longer zero.

Here is what each path actually does, the exact commands, and one credential-storage detail most people never look at. Everything below is quoted from OpenAI’s official documentation and the official GitHub repository (last checked 2026-09-06).

Installing Codex CLI

Three official options. macOS / Linux install script:

curl -fsSL https://chatgpt.com/codex/install.sh | sh

Windows PowerShell:

powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

Or a package manager:

npm install -g @openai/codex
brew install --cask codex

The standalone installers download from https://releases.openai.com/codex by default and fall back to GitHub Releases if metadata or an asset is unavailable; set CODEX_INSTALLER_USE_RELEASES_OPENAI_COM to false to force GitHub Releases. Then just run codex.

The two sign-in paths differ by one line

1. Sign in with your ChatGPT subscription (what most people want)

codex login

This opens a browser and returns your credentials to Codex. The docs call it “the default authentication path when no valid session is available,” and the README recommends signing in with your ChatGPT account so Codex runs as part of your Plus, Pro, Business, Edu, or Enterprise plan — no separate API spend.

2. Sign in with an API key (automation and CI)

OpenAI’s own snippet pipes the key through stdin rather than passing it as an argument:

printenv OPENAI_API_KEY | codex login --with-api-key

Get the key from the OpenAI dashboard. The docs are explicit: “When you sign in with an API key, Codex uses standard API pricing instead of included ChatGPT plan credits.” This path bills you per use. OpenAI positions it for “programmatic Codex CLI workflows, such as CI/CD jobs,” and warns not to expose Codex execution in untrusted or public environments.

Not sure which one you are on?

codex login status
codex logout

One detail worth knowing: the CLI and the IDE extension share the same cached login. Log out of one and you will be signing in again on the other.

What an API key costs you in features

This is the part people discover afterwards. In OpenAI’s plan feature matrix, the “API Key” column is marked unavailable for a long list of things:

A handful of entries are marked “limited” rather than unavailable: Computer Use in the browser, the Chrome integration, Record & Replay on macOS, Plugins, and Memories. The docs do not spell out what “limited” excludes, so neither do we.

Going the other way, one row favours the key: “No training on API or business data by default” is available on the API key column.

Rule of thumb: coding on your own machine, use codex login; running in CI, on a scheduler, or on a shared box, use the API key and accept losing every cloud-side feature.

The detail almost nobody checks: credentials are plaintext by default

Under “Login caching,” the docs state that Codex caches login details locally “in a plaintext file at ~/.codex/auth.json or in your OS-specific credential store.”

If you have never touched the setting, your Codex credentials may be sitting in cleartext in your home directory — which matters on shared machines, on home directories that sync to cloud storage, and in anything that gets swept into a backup.

There is a switch for it in config.toml:

# file | keyring | auto
cli_auth_credentials_store = "keyring"

• file — stores auth.json under CODEX_HOME (default ~/.codex); the plaintext path.
• keyring — uses your operating system credential store.
• auto — OS credential store when available, otherwise auth.json.

Set this to keyring (or at minimum auto) right after installing, then check whether ~/.codex/auth.json still exists. It takes a minute, and what leaks otherwise is a credential that spends your money.

For ChatGPT sign-in sessions, the docs note Codex refreshes tokens automatically before they expire, so active sessions usually continue without another browser login.

When you hit your usage limit

Three official options, in a sensible order:

1. Switch to a smaller model — the docs suggest this directly when you are approaching limits.
2. Buy credits — Plus and Pro users who reach their limit can purchase additional credits instead of upgrading.
3. Run extra local chats with an API key — the docs say all users may do this, charged at standard API rates.

To see where you stand, type /status during a Codex CLI session, or open the usage dashboard on chatgpt.com. OpenAI also warns that similar-looking tasks can consume very different amounts: model choice, context, reasoning, tool use and caching all matter, so “prompt length alone isn’t a reliable estimate.”

Plan prices (official Codex pricing page, as read on the day)

OpenAI explicitly says the per-five-hour message estimates “are not fixed message limits” — check your own usage dashboard rather than trusting an estimate.

Thirty-second version

• Solo, local coding: codex login, subscription quota, full feature set.
• CI or shared machines: printenv OPENAI_API_KEY | codex login --with-api-key — no cloud features, and it bills.
• Either way, set cli_auth_credentials_store = "keyring" so credentials are not plaintext in ~/.codex/auth.json.
• Which am I on: codex login status. How much is left: /status.

Commands and quotes verified 2026-09-06 against OpenAI’s Codex authentication docs, Codex pricing and feature matrix and the official openai/codex README. Plans and features change; the official pages are authoritative. For how Codex usage is billed elsewhere, see our GPT-6 Astra billing check in Copilot and our prompt caching setup guide. Full plan data on the Codex tool page.