Choose the authentication path
ChatGPT sign-in and API-key sign-in use different access and billing arrangements. Do not assume a subscription supplies API credits. Third-party providers also need explicit routing. Decide which path you intend to use before mixing keys or editing files.
codex login statusA direct OpenAI key needs a login step
This example assumes OPENAI_API_KEY is already set securely on your computer. Pass it through standard input rather than placing a real secret in command arguments or screenshots.
printenv OPENAI_API_KEY | codex login --with-api-key
codex login statusIn PowerShell, use $env:OPENAI_API_KEY | codex login --with-api-key. Exporting a variable alone does not establish the cached login for the built-in OpenAI route. A custom provider’s env_key is a separate mechanism covered in the provider guide.
A missing auth.json is not proof of failure
| Value | Storage | What to check |
|---|---|---|
| file | auth.json under CODEX_HOME | Contains secrets; never upload it |
| keyring | OS credential store | Fails if that store is unavailable |
| auto | OS store, with file fallback | A file inspection alone is inconclusive |
| ephemeral | Current process memory | Not persistent; check installed-version support |
cli_auth_credentials_store = "auto"After changing the storage mode, check login status again. Do not assume existing credentials moved automatically. Managed authentication requirements can restrict these choices.
Compare the Client and CLI
- Distinguish local and remote hosts.
- Compare CODEX_HOME and whether the desktop process predates your changes.
- Check storage settings without printing auth.json.
- Prepare the correct login method before signing out; shared credential caches can affect another client.
Validate the actual request
Login status identifies authentication, not the final provider route. Restart, run one small task, and check the model and upstream request logs. A saved key or visible model name is not enough.
For HTTP failures or client differences, continue with the layered troubleshooting checklist.
Sources and version notes
Based on the official documentation below. Replace example URLs, models, and paths for your environment. Older versions and managed environments may differ.
Sources checked：