Sign in

There are two ways to sign in. Pick the one that matches how you pay:

	Sign in with a ChatGPT account	Sign in with an API key
Who it’s for	You topped up Plus / Pro	You use 2api balance or a plan
Billing	Uses the allowance included in your ChatGPT plan	Charged for what you use, from your 2api balance
Features	Everything in ChatGPT and Codex	Codex for coding
How to set it up	Sign in with the ChatGPT account you topped up	One-click setup with magpie

To use both, see Use both.

Sign in with a ChatGPT account

Topped up? Read this first: always sign in with the same account, the same way

Your plan belongs to the account. Whichever account you submitted for the top-up, always sign in with that one. Otherwise you end up in a free account. Common pitfalls:

• If you choose Hide My Email when you sign in with Apple, you get an @privaterelay.appleid.com address. That is not the same account as the one you registered with your real email.
• Accounts registered with Google, Microsoft or Apple may not have a password. If you click Forgot password, no email arrives. Keep signing in the way you did originally.

ChatGPT and Codex use the same account, so once you sign in, you can use both. You can sign in with an email and password, Google, Microsoft, Apple or your company’s single sign-on (SSO).

Desktop app

Open the ChatGPT desktop app, click Continue to sign in, then complete the sign-in in the browser that opens.

Web and mobile

Open chatgpt.com or the mobile app and click Log in.

IDE extension

On the signed-out screen of the Codex panel, click Sign in with ChatGPT, then complete the sign-in in the browser.

CLI

codex login

Choose Sign in with ChatGPT. The browser opens automatically. When you’ve signed in, go back to the terminal. If you just run codex the first time, it also asks you to sign in.

Check which account you’re signed in to: Click your avatar in the bottom-left corner to open the profile menu. It shows the current account. In the CLI, run codex login status. The IDE extension and the CLI share sign-in information, so once you’ve signed in on one, you usually don’t need to sign in on the other.

We recommend turning on two-step verification: Turn it on under Security in settings. You can use an authenticator app or a passkey. Once it’s on, other people can’t sign in even if they get your password.

If the CLI sign-in gets stuck, see CLI sign-in problems at the end of this page.

Sign in with an API key

Choose this if you use 2api balance or a plan. Codex doesn’t sign in to ChatGPT. It calls models with your 2api key, and what you use is charged to your balance. The key must be in a GPT group. See Groups.

The Codex sign-in screen also has an option for an API key, but it connects to OpenAI’s official API by default, so a 2api key won’t work there. Let magpie set it up instead:

Set up every agent with magpieCodex, Claude Code and every other agent in one go, with no config.toml to editOpen→

In magpie, Codex takes just three steps:

1. Click Add 2api GPT and paste your key.
2. On the Agent page, turn on the Connect (接入) toggle for Codex and pick a model under 2api GPT.
3. Fully quit Codex and open it again.

If you’d rather not install magpie, you can write the config by hand: Codex CLI, Codex extension.

Use both

Let magpie handle it. Codex stays signed in with your ChatGPT account, and once magpie connects it, 2api’s models appear right in Codex’s model menu, marked · 2api. Pick one marked · 2api to use your 2api balance, or any other model to use your subscription. You don’t sign out and you don’t edit config.toml.

Use 2api and your ChatGPT subscription together with magpieStay signed in to ChatGPT and pick 2api’s models from the same menuOpen→

Switch by hand, without magpie

First follow the manual setup at the end of ChatGPT sign-in + 2api billing: sign in to the account with ChatGPT, and put both the 2api provider and the key in config.toml. After that, which one you use depends only on the first line of config.toml:

~/.codex/config.toml

# With this line: requests go through 2api and are charged to your 2api balance
model_provider = "sub2api"

# Delete the line above, or add # at its start: use your ChatGPT subscription's usage instead

After the change, fully quit Codex and open it again. To use your subscription’s usage just once, you don’t have to edit the file:

codex -c model_provider="openai"

Sign out

• Desktop app, web and IDE extension: open the profile menu and click Log out.
• CLI: run codex logout. It clears both the ChatGPT sign-in and the API key.

CLI sign-in problems

If you only use the desktop app, the web or your phone, you can skip this section.

The browser sign-in worked, but the terminal is still waiting

In the last step of signing in, the browser has to hand the result back to http://localhost:1455 on your computer. Proxy software, a port that’s already in use, or running Codex on a remote machine can all make this step fail. Try these in order:

1. Make localhost bypass the proxy. In the terminal where you run codex login, set this first:

   macOS / Linux

   export NO_PROXY=localhost,127.0.0.1
   codex login

   Windows PowerShell

   $env:NO_PROXY = "localhost,127.0.0.1"
   codex login

   Also add direct rules for localhost and 127.0.0.1 in your proxy software and in any proxy extension in your browser.

2. Check port 1455 (Windows). Sign-in fails if another program is using the port, or if the port falls inside a range that Windows reserves:

   netstat -ano | findstr :1455
   netsh interface ipv4 show excludedportrange protocol=tcp

   If the first command prints anything, the port is in use. In Task Manager, end the program whose PID matches the last column. If one of the ranges the second command lists includes 1455, open PowerShell as administrator and run net stop winnat, then net start winnat. This often happens after you install Hyper-V, WSL2 or some VPN software.

3. Sign in with a device code instead. See the next section. It doesn’t need a callback to your computer.

Sign in with a device code

Use this on remote servers, in Docker, or when the callback to your computer keeps failing. This feature is currently in beta.

1. First turn on device code sign-in in the security settings of ChatGPT on the web. For a workspace account, ask your admin to turn it on in the workspace permissions.

2. In a terminal, run:

   codex login --device-auth

   Choosing Sign in with Device Code on the interactive sign-in screen does the same thing.

3. On any device, open the link the terminal gives you in a browser, sign in to ChatGPT and enter the one-time code.

Sign in on a remote machine

If you can’t use device code sign-in, there are two other ways.

Copy your local sign-in information over. First run codex login on a computer that has a browser, then copy ~/.codex/auth.json to the same location on the remote machine:

ssh user@remote 'mkdir -p ~/.codex'
scp ~/.codex/auth.json user@remote:~/.codex/auth.json

Forward the callback port to your computer. Connect to the remote machine with the command below, run codex login in that SSH session, then open the address it prints in your local browser:

ssh -L 1455:localhost:1455 user@remote

auth.json is as good as your password

auth.json stores your sign-in credentials. Don’t commit it to Git, and don’t post it in group chats or support tickets.

Corporate networks and sign-in logs

• If your network has a corporate TLS proxy or a private root certificate, set CODEX_CA_CERTIFICATE before you sign in. Point it at the certificate file in PEM format:

  export CODEX_CA_CERTIFICATE=/path/to/corporate-root-ca.pem
  codex login

• Each run of codex login writes its own codex-login.log, by default in the ~/.codex/log folder. If you contact support about a sign-in problem, you can attach it. Look through it before you send it, and leave out anything sensitive.

---

This page follows OpenAI’s official documentation, checked in October 2026. OpenAI updates often, so button names and menu locations may differ slightly. Go by what you see on screen.