Skip to main content
Codex CLI is OpenAI’s terminal coding agent. Bifrost connects it through a named custom provider backed by the OpenAI-compatible Responses API.
Codex CLI sends a session-id header on every request, so a session sticks to the provider and key that served it and keeps hitting the same prompt cache, with nothing to configure. See Session Affinity.

​
Install Codex CLI

A new virtual key with no provider_configs denies all providers by default. Make sure openai/gpt-5 (or the model you choose) appears in bifrost models list before launching, or the request is rejected.
Bifrost creates an isolated temporary CODEX_HOME for the launched process and declares a bifrost model provider. It copies the user’s config.toml first, preserving MCP servers, project trust entries, reasoning preferences, and other non-auth settings before replacing the model-provider routing. The user’s normal authentication and session history remain isolated, and changes Codex makes inside the temporary home are discarded when the process exits. Enterprise SSO and virtual keys are both supported. With SSO, Codex receives the current Bifrost agent access token only in its child-process environment. The token is not written to the temporary Codex provider configuration.
Codex currently receives one agent access token when the process starts. If a long-running Codex session reaches token expiry, exit and relaunch it through Bifrost so the CLI can refresh the Enterprise session first.

​
Configure Codex manually with a virtual key

Codex prefers an existing OpenAI OAuth session over custom API credentials. Run /logout before using a manually configured Bifrost provider. This is not required for bifrost run codex, which uses an isolated temporary home.
Export the virtual key in the same terminal used to start Codex:
Add a named provider to ~/.codex/config.toml:
The trailing /v1 is required because Codex appends /responses to the custom provider URL. supports_websockets = false keeps the custom provider on HTTP(S) Responses requests, which is required when Bifrost translates the request to a provider that does not implement OpenAI’s stateful Responses WebSocket protocol.
Use a named model_providers entry. Setting only OPENAI_BASE_URL or OPENAI_API_KEY can leave Codex on its built-in OpenAI provider, where OpenAI OAuth and built-in transport behavior can take precedence.

​
Select a model

Pass the complete Bifrost model identifier when starting the session:
Or, when starting Codex directly from a manually configured shell:
Codex’s in-session /model picker uses Codex’s model catalog, not Bifrost’s /v1/models response. Provider-qualified Bifrost models may not appear there, and entering an arbitrary value after /model can leave the previous model active. Use /status to verify the model. For a model outside the picker, exit and relaunch with bifrost run codex --model provider/model.
The Bifrost launcher currently validates gateway connectivity and discovers the permitted models, but it does not generate a Codex model-catalog file.

​
Non-OpenAI models

Bifrost can translate Codex’s Responses API requests to other configured providers. The target model must support the tool calls Codex needs for file operations, shell commands, and edits. Provider support for streaming, reasoning items, parallel tools, images, and compaction can also differ.
The current automated Codex cloud harness exercises the OpenAI provider path. Treat other provider/model combinations as compatibility targets to validate with your selected model before production rollout.
A quick isolation sequence is:
Inside Codex, run /status before sending the first task. If Bifrost’s error payload reports a different original_model_requested, Codex did not switch to the intended model.

​
Troubleshooting

​
The request still uses gpt-5

The in-session model change did not take effect. Relaunch with the desired model on the command line and verify it with /status.

​
The request is routed to the wrong provider key

Bifrost routes from the model actually sent by Codex. Inspect original_model_requested in the error response or the Bifrost logs. Fixing a provider-key error will not change Codex’s active model.

​
401 Unauthorized

When using Bifrost CLI, run:
When configuring Codex manually, confirm that model_provider = "bifrost", requires_openai_auth = false, and OPENAI_API_KEY contains a Bifrost virtual key.

​
Next steps