Authentication and environment

Codex CLI authentication is local to the process. Run codex and sign in with ChatGPT, or configure API-key authentication using the OpenAI Codex authentication guide.

The TypeScript SDK inherits the parent process environment by default. Pass env to control what the child CLI receives:

Copyconst codex = new Codex({
  env: {
    PATH: "/usr/local/bin",
    CODEX_API_KEY: process.env.CODEX_API_KEY ?? "",
  },
});

Never commit API keys or pass them to untrusted workspaces. For MCP servers, configure each server's credentials in the Codex configuration or use codex mcp login for OAuth-capable servers.