Codex CLI Guide: Install, Login, Approval and Sandbox Setup

Codex CLI is a tool that lets you hand tasks to OpenAI's coding agent from the terminal. You run one install command and sign in with your ChatGPT account (as of October 20, 2026). Start with Auto, which edits and runs commands automatically inside your working folder only. If the folder is not under version control, start with Read-only, which can only read.

Decide this before you first launch Codex CLI

After installing, the first question you face when you open Codex in the terminal is: "How far can it touch my files?" Think of handing your house key to a new interior contractor. If you only hire them for the living room, you open only the living room door. The master bedroom and the safe need separate permission. Codex works the same way. It edits freely inside the working folder, and it asks before anything that crosses the line, such as touching files outside the folder or reaching the internet. There is also a setting that hands over every key (yolo), so never start without knowing which one you picked.

According to the OpenAI docs, Codex CLI works like this: you run codex in a project folder and describe the task, and the terminal shows the commands it runs and the changes (diff) in real time. Unlike tasks that run in the cloud, it works directly on files on your own computer, so permission settings matter more. If you are curious about cloud tasks, read how to start Codex cloud tasks and the plan requirements first.

Install and sign in to Codex CLI

On macOS and Linux, run the line below in the terminal. The OpenAI docs say the same command is used for updates.

curl -fsSL https://chatgpt.com/codex/install.sh | sh

When the install finishes, move to the project folder you want to work on and run codex. On first launch you see sign-in options, including "Sign in with ChatGPT". If you sign in with a ChatGPT account, you use the Codex usage included in that plan. In the docs' command reference, codex login opens a browser login by default. On a server where a browser is hard to open, add --device-auth (device code flow). To use an API key, add --with-api-key.

You can confirm success in two places. Run codex login status in the terminal, and if you are signed in it returns exit code 0. Type /status inside the chat window to see the current session settings and your remaining limit. Finishing the install command is not the same as being signed in, so do this check once before giving Codex its first task.

Windows does not use the one-line command for macOS and Linux as is. Follow the Windows tab on the official install page, and choose your runtime in the Windows section below.

Codex CLI basics and slash commands

Interactive use is simply running codex and describing the task. You can change direction while a task is running. The first task the same docs suggest is typing /init in the project to create AGENTS.md, an instruction file that Codex reads. If you write your build commands and the rules to follow there, you do not have to repeat the same explanation every time.

Input	What it does
codex	Opens the interactive screen in the current folder
codex exec	Non-interactive run that finishes without human input. Use it for repeated tasks or CI
codex resume	Continues a previous conversation (reopens recent conversations in the current repository). --last is the most recent session in this folder
/init	Creates the AGENTS.md instruction file
/status	Shows current session settings and remaining limit
/permissions	Choose what Codex can do without asking, and check the current sandbox
/model	Choose the model and reasoning effort
/review	Reviews the changes to find problems

You can change the model for a single run with --model (-m). If you need up-to-date web search, add --search. Without this option, web search uses pre-stored (cached) results.

Codex CLI approval modes and sandbox: which to start with

The sandbox is what Codex is technically able to do (where it can write and whether it can reach the internet). The approval policy is when it asks a human first. The agent approvals and security doc splits usage into four ways.

Name	Setting	Behavior
Auto	No flag, or --sandbox workspace-write --ask-for-approval on-request	Reads, edits and runs commands automatically in the working folder. Asks for approval for edits outside the folder or commands that need the network
Read-only	--sandbox read-only --ask-for-approval on-request	Operates only inside a read-only sandbox. Anything else needs approval
Read-only non-interactive (CI)	--sandbox read-only --ask-for-approval never	Runs read-only and never asks for approval
Dangerous full access	--dangerously-bypass-approvals-and-sandbox (--yolo)	No sandbox and no approvals. The docs do not recommend this mode

The deciding factor is the type of folder. The docs recommend Auto for folders under version control such as Git, and Read-only for folders without version control. The difference is whether you can undo changes. With version control, you can roll back a file that Codex edited wrongly. Without it, you have no way to do that. For a folder you do not trust yet, you can start with Read-only until you set trust in onboarding or in /permissions.

Even in Auto, commands reaching the internet are off by default. If you really need access, such as for installing packages, follow the approvals and security doc and turn it on by putting network_access = true under [sandbox_workspace_write] in the config file (config.toml). The docs say to use --yolo only on an isolated computer or virtual environment, and in that case web search also defaults to live.

After changing settings, open /permissions and check that the current sandbox and writable folders are what you intended. If your config file still has the old value approval_policy = "untrusted", remove it. The docs list it as deprecated, so the client may fail to start.

Using Codex CLI on Windows: PowerShell and WSL

According to the Windows sandbox doc, Codex can run directly in PowerShell without WSL or a virtual machine. Choose WSL if you need Linux-only tools or your work environment is already in WSL2. PowerShell uses the Windows sandbox, and WSL2 uses the Linux sandbox.

There are three Windows sandboxes. mxc is the recommended option on compatible devices. It needs no administrator approval setup, but it requires Windows 11 24H2 or 25H2 at or above a specified build. If you cannot use mxc, prefer elevated, which needs administrator approval setup. Use unelevated only as a last resort when policy allows it, such as on a company PC where admin setup is blocked. Unelevated has weaker network isolation. For the legacy modes, you specify them under [windows] in config.toml, like sandbox = "elevated".

With CLI 0.162.0 or later, you can test once whether mxc works without changing your settings. Run the docs' test command (codex -c windows.sandbox=mxc sandbox ... echo MXC_OK) in PowerShell. If it prints MXC_OK and the exit code is 0, it works.

Codex CLI usage limits and plans

According to the OpenAI pricing page, Codex is included in ChatGPT plans such as Free, Go, Plus, Pro and Business, and usage differs by plan. The Plus plan description says you can use Codex on the web, in the CLI, in the IDE extension and on iOS. Free and Go list the GPT-6 Luna model for light coding tasks.

Plan	Monthly price	Codex coverage
Free	$0	Try simple coding tasks
Go	$8	Light coding tasks, GPT-6 Luna
Plus	$20	Web, CLI, IDE extension, iOS, GPT-6.1 Sol and Luna, extra usage with credits
Pro	From $100 ($100, $200, $500)	No 5-hour limit. Ultrafast starts at $500
Business	$20 per user (annual billing, $25 monthly)	2 or more users

The estimated local messages per 5 hours for Plus and standard Business are 15 to 160 for GPT-6.1 Sol, 5 to 45 for GPT-6 Astra, and 350 to 3,000 for GPT-6 Luna. These are not fixed limits. They vary by task type, and weekly limits may also apply. In the table above, Luna's estimated message count is roughly ten times Sol's. If your limit is running down fast, you can save usage by switching only simple tasks to Luna with /model. For price comparisons, continue with the ChatGPT plan price and limit comparison (in Korean).

According to the pricing page, GPT-5.5 was retired on October 14, 2026 for Codex used with a ChatGPT login. If you have a setup that kept using this model, you need to pick another model in /model. Sessions signed in with an API key are not affected by this retirement.

Check your Codex CLI permission settings yourself

Before applying this to a real project, a 10-minute check in an empty temporary folder makes the difference between the two modes visible. First open it with codex --sandbox read-only --ask-for-approval on-request and ask "create a hello.txt file." Per the docs, a read-only sandbox cannot write files, so Codex should ask for approval or say it cannot create the file. Then reopen codex with no options and make the same request. Because this is Auto mode, see whether the file appears in the folder right away, and whether it asks for approval when you request a path outside the folder. If the result differs from the docs, check the current sandbox in /permissions.

Common mistakes when first using Codex CLI

First, giving a big task in Auto mode in a folder without version control. You cannot undo a wrongly edited file, so first create a repository with git init and then start, or use Read-only and only ask for a plan. Second, adding --yolo out of habit to remove the safeguards. If approval prompts are annoying, open only the folder access and network you need in the config file instead of using yolo. Third, feeling that your limit suddenly filled up but not checking /status. The pricing page says ChatGPT Work and Codex share the same usage, credits and limits, so check what remains in the dashboard and with /status.

If you also use Claude Code, how to split Claude Code and Codex accounts per session helps with limit management.

Frequently asked questions

Can I use Codex CLI without an API key?

Yes. If you sign in with a ChatGPT account on first launch, it runs on the usage included in your plan. To use an API key instead, choose it separately with codex login --with-api-key.

Can I close a Codex CLI conversation and continue later?

Yes. Run codex resume to pick a previous conversation. Add --last to open the most recent session in the current folder right away.

When should I use codex exec?

Use it for repeated tasks or CI that must finish even when no one is at the screen. You can receive progress events with --json or save the last response to a file with -o.