Codex
Install a supported Node.js LTS release, install Codex, create a dedicated key, then copy the version-matched config.toml and auth.json from API Keys -> Use key into the default .codex directory. Fully quit and reopen Codex after every configuration change.
Before you begin
Install only the current client release from its official publisher. Before changing local configuration, create a dedicated API key in the console; never reuse a personal, shared, or production deployment key.
Windows, macOS, and Linux
- Windows: use the current Windows installer or PowerShell workflow, then close all client processes after changing a config file.
- macOS: use the signed app or official terminal installer for your CPU; home-directory settings belong to that macOS user.
- Linux / WSL: follow the current distribution or official CLI instructions; WSL reads its Linux home directory, not the Windows profile directory.
Choose a model
Call GET /v1/models with the dedicated key and choose one returned data[].id. This key-scoped list is authoritative; a model in a previous configuration, article, or client picker is not an access guarantee.
Configure
npm install -g @openai/codex
codex --versionmodel_provider = "OpenAI"
model = "your-console-model"
[model_providers.OpenAI]
base_url = "https://ai.tavonilo.com"
wire_api = "responses"Verify
Check the key with /v1/models, make one small non-sensitive request, and retain only the timestamp, route, model, HTTP status, and request ID for support. A timeout does not prove a billable generation was not processed, so do not blindly replay long or image requests.
Recover safely
- 401: replace an incomplete, revoked, or wrong key; never paste it into a support request.
- 403: check the key group, model visibility, balance, and route permission.
- 404: use the base URL shown here, not a full endpoint, and do not append /v1 twice.
- 429: queue work and honor Retry-After when present; do not replay a batch concurrently.
- 5xx or timeout: make a bounded retry only when the operation is safe to retry. Keep time, route, model, HTTP status, and request ID in redacted logs.
Credential boundary
Use one key per device or workload. Never send an API key, auth.json, full private prompt, password, verification code, or payment data to support; revoke and replace a key immediately when exposure is suspected.