# Sign in
There are two ways to sign in. Pick the one that matches how you pay:
| | Sign in with a ChatGPT account | Sign in with an API key |
| --- | --- | --- |
| Who it's for | You topped up Plus / Pro | You use 2api balance or a plan |
| Billing | Uses the allowance included in your ChatGPT plan | Charged for what you use, from your 2api balance |
| Features | Everything in ChatGPT and Codex | Codex for coding |
| How to set it up | [Sign in with the ChatGPT account you topped up](#sign-in-with-a-chatgpt-account) | [One-click setup with magpie](#sign-in-with-an-api-key) |
To use both, see [Use both](#use-both).
## Sign in with a ChatGPT account
:::caution[Topped up? Read this first: always sign in with the same account, the same way]
Your plan belongs to the account. Whichever account you submitted for the top-up, always sign in with that one. Otherwise you end up in a free account. Common pitfalls:
- If you choose **Hide My Email** when you sign in with Apple, you get an `@privaterelay.appleid.com` address. That is not the same account as the one you registered with your real email.
- Accounts registered with Google, Microsoft or Apple may not have a password. If you click **Forgot password**, no email arrives. Keep signing in the way you did originally.
:::
ChatGPT and Codex use the same account, so once you sign in, you can use both. You can sign in with an email and password, Google, Microsoft, Apple or your company's single sign-on (SSO).
Open the ChatGPT desktop app, click **Continue to sign in**, then complete the sign-in in the browser that opens.
Open [chatgpt.com](https://chatgpt.com) or the mobile app and click **Log in**.
On the signed-out screen of the Codex panel, click **Sign in with ChatGPT**, then complete the sign-in in the browser.
```bash
codex login
```
Choose **Sign in with ChatGPT**. The browser opens automatically. When you've signed in, go back to the terminal. If you just run `codex` the first time, it also asks you to sign in.
**Check which account you're signed in to**: Click your avatar in the bottom-left corner to open the profile menu. It shows the current account. In the CLI, run `codex login status`. The IDE extension and the CLI share sign-in information, so once you've signed in on one, you usually don't need to sign in on the other.
**We recommend turning on two-step verification**: Turn it on under **Security** in settings. You can use an authenticator app or a passkey. Once it's on, other people can't sign in even if they get your password.
If the CLI sign-in gets stuck, see [CLI sign-in problems](#cli-sign-in-problems) at the end of this page.
## Sign in with an API key
Choose this if you use 2api balance or a plan. Codex doesn't sign in to ChatGPT. It calls models with your 2api key, and what you use is charged to your balance. The key must be in a GPT group. See [Groups](https://docs.2api.dev/en/start/endpoints/#groups).
The Codex sign-in screen also has an option for an API key, but it connects to OpenAI's official API by default, so a 2api key won't work there. Let magpie set it up instead:
Codex, Claude Code and every other agent in one go, with no config.toml to edit
In magpie, Codex takes just three steps:
1. Click **Add 2api GPT** and paste your key.
2. On the Agent page, turn on the Connect (接入) toggle for Codex and pick a model under 2api GPT.
3. Fully quit Codex and open it again.
If you'd rather not install magpie, you can write the config by hand: [Codex CLI](https://docs.2api.dev/en/clients/codex/), [Codex extension](https://docs.2api.dev/en/clients/codex-ide/).
## Use both
Let magpie handle it. Codex stays signed in with your ChatGPT account, and once magpie connects it, 2api's models appear right in Codex's model menu, marked **· 2api**. Pick one marked · 2api to use your 2api balance, or any other model to use your subscription. You don't sign out and you don't edit `config.toml`.
Stay signed in to ChatGPT and pick 2api's models from the same menu
Switch by hand, without magpie
First follow the manual setup at the end of [ChatGPT sign-in + 2api billing](https://docs.2api.dev/en/clients/codex-login/): sign in to the account with ChatGPT, and put both the 2api provider and the key in `config.toml`. After that, which one you use depends only on the first line of `config.toml`:
```toml title="~/.codex/config.toml"
# With this line: requests go through 2api and are charged to your 2api balance
model_provider = "sub2api"
# Delete the line above, or add # at its start: use your ChatGPT subscription's usage instead
```
After the change, fully quit Codex and open it again. To use your subscription's usage just once, you don't have to edit the file:
```bash
codex -c model_provider="openai"
```
## Sign out
- Desktop app, web and IDE extension: open the profile menu and click **Log out**.
- CLI: run `codex logout`. It clears both the ChatGPT sign-in and the API key.
## CLI sign-in problems
If you only use the desktop app, the web or your phone, you can skip this section.
### The browser sign-in worked, but the terminal is still waiting
In the last step of signing in, the browser has to hand the result back to `http://localhost:1455` on your computer. Proxy software, a port that's already in use, or running Codex on a remote machine can all make this step fail. Try these in order:
1. **Make localhost bypass the proxy.** In the terminal where you run `codex login`, set this first:
```bash
export NO_PROXY=localhost,127.0.0.1
codex login
```
```powershell
$env:NO_PROXY = "localhost,127.0.0.1"
codex login
```
Also add direct rules for `localhost` and `127.0.0.1` in your proxy software and in any proxy extension in your browser.
2. **Check port 1455 (Windows).** Sign-in fails if another program is using the port, or if the port falls inside a range that Windows reserves:
```powershell
netstat -ano | findstr :1455
netsh interface ipv4 show excludedportrange protocol=tcp
```
If the first command prints anything, the port is in use. In Task Manager, end the program whose PID matches the last column. If one of the ranges the second command lists includes 1455, open PowerShell as administrator and run `net stop winnat`, then `net start winnat`. This often happens after you install Hyper-V, WSL2 or some VPN software.
3. **Sign in with a device code instead.** See the next section. It doesn't need a callback to your computer.
### Sign in with a device code
Use this on remote servers, in Docker, or when the callback to your computer keeps failing. This feature is currently in beta.
1. First turn on device code sign-in in the security settings of ChatGPT on the web. For a workspace account, ask your admin to turn it on in the workspace permissions.
2. In a terminal, run:
```bash
codex login --device-auth
```
Choosing **Sign in with Device Code** on the interactive sign-in screen does the same thing.
3. On any device, open the link the terminal gives you in a browser, sign in to ChatGPT and enter the one-time code.
### Sign in on a remote machine
If you can't use device code sign-in, there are two other ways.
**Copy your local sign-in information over.** First run `codex login` on a computer that has a browser, then copy `~/.codex/auth.json` to the same location on the remote machine:
```bash
ssh user@remote 'mkdir -p ~/.codex'
scp ~/.codex/auth.json user@remote:~/.codex/auth.json
```
**Forward the callback port to your computer.** Connect to the remote machine with the command below, run `codex login` in that SSH session, then open the address it prints in your local browser:
```bash
ssh -L 1455:localhost:1455 user@remote
```
:::caution[auth.json is as good as your password]
`auth.json` stores your sign-in credentials. Don't commit it to Git, and don't post it in group chats or support tickets.
:::
### Corporate networks and sign-in logs
- If your network has a corporate TLS proxy or a private root certificate, set `CODEX_CA_CERTIFICATE` before you sign in. Point it at the certificate file in PEM format:
```bash
export CODEX_CA_CERTIFICATE=/path/to/corporate-root-ca.pem
codex login
```
- Each run of `codex login` writes its own `codex-login.log`, by default in the `~/.codex/log` folder. If you contact support about a sign-in problem, you can attach it. Look through it before you send it, and leave out anything sensitive.
---
This page follows OpenAI's official documentation, checked in October 2026. OpenAI updates often, so button names and menu locations may differ slightly. Go by what you see on screen.