Codex CLI: Install, Sign In and Safe Permissions

Codex CLI is OpenAI's coding agent that runs in your terminal. It reads your project, edits files and runs commands for you. Install it with one command from OpenAI's docs, sign in with your ChatGPT account or an API key, and leave the default sandbox and approval settings on. The setting to avoid is --dangerously-bypass-approvals-and-sandbox, which OpenAI itself marks "not recommended".

By Gary, Greenlight My App. Checked Nov 1, 2026. How we checked this: we read OpenAI's Codex CLI, pricing and security docs on Nov 1, 2026 and quote them below. On Nov 1, 2026 we tested install, help and the sign-in screen only: we installed codex-cli 0.166.0 with npm in a throwaway home folder, ran codex --help, opened the sign-in screen and exited without signing in. We haven't tested coding tasks, so we make no claims about output quality. Screenshots labeled "docs" are of OpenAI's pages, not our test. Drafted with AI tools and reviewed by a person before publishing.

What is Codex CLI?

Codex CLI is a command-line program from OpenAI. You open a terminal in your project folder, type codex, and describe what you want: "add a login page", "fix this failing test", "explain this file". Codex reads the relevant files, proposes changes, and can run commands like your test suite.

It's one of several ways to use Codex. OpenAI's pricing page says Codex is available "on the web, in the CLI, in the IDE extension, and on iOS" on paid plans, and there's a desktop app as well. The CLI is the version for people who live in the terminal or want to script the agent.

If you're choosing between agents, our Codex vs Claude Code comparison covers pricing and safety settings side by side. OpenCode is an open-source alternative that works with several model providers.

How do you install Codex CLI?

OpenAI's Codex CLI page (external) gives this install command (checked Nov 1, 2026):

curl -fsSL https://chatgpt.com/codex/install.sh | sh

The same page also has npm and Homebrew tabs, if you prefer a package manager. Pick one method and stick with it, so you don't end up with two copies on your PATH.

Before piping any script into your shell, you can open the URL in a browser and read it. That's a good habit with every installer, not just this one.

In our test we used npm (npm install -g @openai/codex), which installed codex-cli 0.166.0. Then check the install:

codex --version
codex --help

You should see a list of commands and flags. If your shell says "command not found", open a new terminal window so it picks up the updated PATH.

How do you update Codex CLI?

OpenAI's docs say to run the same install command again to update:

curl -fsSL https://chatgpt.com/codex/install.sh | sh

If you installed with npm or Homebrew, update through that tool instead. The docs page showed a version number when we checked, but versions move quickly, so trust what codex --version says on your machine.

How do you uninstall Codex CLI?

Remove it with the same tool you installed it with. For npm or Homebrew, use their uninstall command. For the script install, delete the codex binary from where the installer put it (run which codex to find it). Codex keeps settings in a .codex folder in your home directory; delete that too if you want a clean slate, after saving anything you need.

How do you sign in to Codex CLI?

The first time you run codex, it asks you to sign in. OpenAI's docs say to "choose Sign in with ChatGPT or another available sign-in method".

When we opened Codex for the first time, the sign-in screen offered four choices: "Sign in with ChatGPT" ("Usage included with Plus, Pro, Business, and Enterprise plans"), "Sign in with Device Code", "Use an OpenAI API key" ("Pay for what you use") and "Use Amazon Bedrock". We exited at this screen without signing in.

The two main paths:

1. Sign in with ChatGPT. Your usage counts against your ChatGPT plan's Codex limits. No API key involved.
2. Use an OpenAI API key. OpenAI's pricing page says API-key use means you "Pay for Codex usage based on API pricing". You're billed per token on your API account.

If you use an API key, never paste it into a project file that gets committed. Set it as an environment variable in your shell profile or a secret manager instead:

export OPENAI_API_KEY="sk-XXXX"

Our guide on how to get an OpenAI API key covers creating a key with a spending limit. If a key ever lands in Git history, follow what to do when an .env file is committed.

Is Codex CLI free?

Partly. OpenAI's Codex pricing page (external) says "ChatGPT Work and Codex are included in your ChatGPT Free, Go, Plus, Pro, Business, Edu, or Enterprise plan". But the plans don't all include the same places to use Codex. Here's what the page listed on Nov 1, 2026, quoted word for word:

So the Free and Go descriptions point to the desktop app, and the CLI is named under Plus. If you want the CLI on a ChatGPT login, check your plan's row on the pricing page before you count on it. The other route is an API key, billed per use.

OpenAI also says usage limits are estimates, not fixed numbers. Type /status inside Codex to see your remaining usage.

Your first safe Codex CLI session

Start cautious, then loosen up as you learn how Codex behaves on your project.

1. Commit or stash your work first, so git diff shows only what Codex changes.
2. Start in read-only mode and ask Codex to explain the project or plan a change.
3. Run /init to create AGENTS.md, and add your rules: where secrets live, which folders are off limits, which tests to run.
4. Switch to Auto with /permissions when you're ready for edits.
5. Read every approval prompt before you say yes. If you don't understand a command, say no and ask Codex to explain it.

What are Codex CLI's sandbox and approval modes?

This is the part worth getting right. Codex has two controls that work together:

• Sandbox: what Codex is technically able to do (read files, write files, use the network).
• Approvals: when Codex has to stop and ask you first.

OpenAI's security docs (external) list presets. The two you'll use most:

Auto (the usual choice for a project in Git):

codex --sandbox workspace-write --ask-for-approval on-request

Codex can edit files inside your project folder and asks before doing things outside it.

Read-only (for exploring code you don't want touched):

codex --sandbox read-only --ask-for-approval on-request

Codex can read and suggest, but asks before any change.

The docs say Codex recommends Auto for folders under version control and read-only for folders that aren't. That makes sense: with Git, you can undo a bad edit with git diff and git restore.

Two more defaults from the docs worth knowing:

• "By default, the agent runs with network access turned off." Codex can't fetch from the internet unless you allow it.
• Some paths stay read-only even in workspace-write mode, including .git, .agents, .codex and .aws.

Inside a session, /permissions lets you view and change these settings.

Older guides mention approval_policy = "untrusted". OpenAI's docs list it as retired, so don't copy configs that use it.

What does --yolo do in Codex?

The flag --dangerously-bypass-approvals-and-sandbox (OpenAI lists --yolo as its alias) turns off both protections. OpenAI's docs describe it as: "No sandbox; no approvals (not recommended)".

In that mode Codex can run any command on your machine, with your user's permissions, without asking. Some people use it inside a throwaway container or VM where nothing important is reachable. On your everyday laptop, with your SSH keys, browser sessions and cloud credentials, it's a bad trade for a little speed.

Can Codex see my .env file?

Yes, if it's inside your project folder. OpenAI's protected-paths list names .git, .agents, .codex and .aws, but it doesn't mention .env. Assume Codex can read any file in the workspace, including your secrets file.

Ways to lower the risk:

1. Keep production keys out of your local .env. Use test or development keys locally, with tight spending limits.
2. Load real secrets from a secret manager or your hosting provider's dashboard, not a file in the repo.
3. Check .gitignore so .env is never committed. Our .env file explainer covers the setup. git check-ignore -v .env tells you which rule ignores it.

4. Review diffs before committing. Agents sometimes copy a value from a config file into code "to make it work". That's how keys end up in a frontend bundle.

Which Codex CLI commands should you know?

From OpenAI's CLI docs, the commands you'll reach for most:

• /init creates an AGENTS.md file, where you write project rules for the agent ("never edit migrations", "run npm test before finishing").
• /status shows your model, settings and remaining usage.
• /permissions views or changes sandbox and approval settings.
• /model switches the model.
• /review asks Codex to review your current changes.
• codex exec "..." runs a task non-interactively, handy in scripts.
• codex resume picks up an earlier session.
• codex mcp manages MCP servers, which connect Codex to outside tools.
• --search lets Codex search the web for a session.

A good AGENTS.md is one of the simplest safety wins. Tell the agent where secrets live and that it must never print, copy or commit them.

Before you push: review what Codex changed

Codex can write code fast. Your job is to check it before it goes anywhere public.

• Run git diff and read every changed file, not just the summary.
• Search the diff for key, secret, token and sk-. A fake key should look like sk-XXXX; a real one shouldn't be there at all.
• Check that .env is still in .gitignore and not staged: git status.
• Look for API calls that moved into browser code.
• Run your tests yourself.
• Ask /review for a second look, then make the final call yourself.

Codex CLI vs Claude Code: which is safer?

Both are terminal agents with sandboxing and approval prompts, and both can be configured tightly or loosely. We've tested Codex only as far as install, help and the sign-in screen, and haven't tested Claude Code, so we won't rank them. Our Codex vs Claude Code post compares their documented settings and prices, and our Claude Code install guide covers that side.

Whichever you pick, the habits matter more than the brand: keep approvals on, keep real keys out of the workspace, and read the diff.

Does OpenAI train on my Codex code?

OpenAI's data controls help page (external) says Codex has "a separate Include environments setting in Codex settings that controls whether additional context from your Codex environments can be used to train OpenAI models," and that changing your ChatGPT training setting doesn't change it. Check both settings if this matters to you. The same page says OpenAI doesn't use API Platform inputs and outputs for training by default.

FAQ

Is Codex CLI free? OpenAI says Codex is included on Free, but the Free row points to the desktop app. The CLI is listed under Plus ($20/month, checked Nov 1, 2026) or usage-based with an API key.

Does Codex CLI need an API key? No. You can sign in with ChatGPT instead. An API key is an option, and OpenAI bills that use at API pricing.

Can Codex see my .env file? Yes, if it's in your project folder. OpenAI's protected paths don't include .env, so keep production keys out of the workspace.

Is Codex CLI better than Claude Code? We haven't tested either one enough to rank them. Both have sandbox and approval controls; compare their docs and try them on a small task.

How do I update Codex CLI? Run the install command again, per OpenAI's docs: curl -fsSL https://chatgpt.com/codex/install.sh (external) | sh. Use npm or Homebrew if you installed that way.

How do I uninstall Codex CLI? Use the tool you installed with (npm, Homebrew), or delete the codex binary found with which codex. Remove ~/.codex for a clean slate.

Codex wrote it; check what you deploy. Run a free scan with Greenlight My App to check your live site's public code for exposed API keys and missing security headers.