Run Codex in a sandbox

Sign inCopy Anchor Link

Use one of these three methods.

With an OpenAI API keyCopy Anchor Link

Put the key in the env of the sandbox:

{
  "CODEX_API_KEY": "sk-..."
}

• codex exec reads CODEX_API_KEY for each run.
• For the terminal UI, sign in with the key one time: printenv CODEX_API_KEY | codex login --with-api-key.
• OpenAI recommends an API key for automation. See authentication.

With a ChatGPT planCopy Anchor Link

Sign in over SSH. Use a device code or your browser.

With a device code:

1. Turn on device code sign-in in the security settings of ChatGPT, or of your workspace.
2. Run codex login --device-auth.
3. Open the link on a device, and type the code.

With your browser:

1. Connect with ssh -L 1455:localhost:1455.
2. Run codex login.
3. Open the link in the browser of your computer. The forward sends the sign-in to the sandbox.

• Codex keeps the sign-in in ~/.codex/auth.json. Each later codex exec uses it.
• Codex uses the usage limits of your plan.

With the open models of Munito AICopy Anchor Link

1. Put your Munito AI key in the env of the sandbox as MUNITO_API_KEY.
2. Write this configuration to ~/.codex/config.toml, with the files API or a command:

model = "zai-org/glm-5.3-flash"
model_provider = "munito"

[model_providers.munito]
name = "Munito"
base_url = "https://api.munito.ai/inference/v1"
env_key = "MUNITO_API_KEY"
wire_api = "responses"

Codex with open models explains the provider, the model metadata and the regional hosts.

Run a taskCopy Anchor Link

curl -sS --fail-with-body "https://api.munito.ai/sandboxes/v1/sandboxes/$SANDBOX/exec" \
  -H "Authorization: Bearer $MUNITO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"command": "cd /workspace && codex exec --skip-git-repo-check --dangerously-bypass-approvals-and-sandbox \"Write a Python script that prints the first 10 primes, and run it\"", "timeout": 1800}'

• codex exec runs one task, and then it stops. It writes the progress to standard error, and the last message to standard output.
• --dangerously-bypass-approvals-and-sandbox lets Codex run commands and change files with no question. The sandbox of Munito AI isolates Codex, so Codex does not need its own sandbox.
• Without this flag, codex exec can only read files.
• --skip-git-repo-check lets Codex work in a folder that is not a Git repository. In a cloned repository, remove it.
• --json gives each event of Codex as one line of JSON. With "stream": true in the request, the events come during the task.
• For a task of more than 30 minutes, start codex exec in the background with nohup, and read its log with later commands.

Use the terminal UICopy Anchor Link

1. Add your public key with SSH.
2. Connect with the command that GET /sandboxes/{sandbox_id}/ssh gives.
3. Run codex in /workspace.

To keep the session after you disconnect, install tmux (apt-get install -y tmux), and start Codex in it.