> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pullfrog.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Codex subscription

If your ChatGPT account has Codex access, you can use it with Pullfrog instead of paying for OpenAI API tokens on top. Pullfrog runs OpenAI models through your Codex access via the [Codex CLI](https://developers.openai.com/codex/cli) — the same flow `codex login --device-auth` uses on your laptop. Codex is currently included across ChatGPT plans, with plan-specific usage limits.

<Note>
  Codex auth is for OpenAI models specifically. For other providers, see [BYOK](/keys) or [Pullfrog Router](/billing#pullfrog-router).
</Note>

## Setup

Run one command from inside a repository owned by the organization you want to configure:

```bash theme={null}
npx pullfrog auth codex
```

The CLI:

1. Spawns `codex login --device-auth` in an isolated environment (your local `~/.codex/auth.json` is never touched).
2. Prints a URL and one-time code — open the URL, sign in to ChatGPT, approve the code.
3. Stores the resulting credential as `CODEX_AUTH_JSON` in Pullfrog's encrypted secret store.

That's it. The next workflow run on this repo will use your Codex access instead of needing an OpenAI API key.

<Note>
  You don't need to install the Codex CLI separately if it's already on your PATH. If it isn't, the command will print install instructions. On org-owned repos, the CLI prompts you to pick a storage scope: **account** (shared across every repo your org owns) or **repo** (just this repo). User-owned repos store at account scope. A repo's own credential takes precedence over the account's, so an account-scope save stops when some repo has its own copy: the CLI names those repos, prints the `secret delete` line for each, and saves nothing. Run those lines and try again, or pass `--repo` to replace one repo's copy instead.
</Note>

## When to use this

* You already have Codex access through ChatGPT and don't want to also pay per OpenAI API token.
* You want the simplest setup — one command, no API key management, no GitHub Actions secrets.
* You're OK with OpenAI's [Codex Terms of Service](https://openai.com/policies/business-terms) applying to your usage.

## How it works

Once stored, Pullfrog injects the credential at the start of each workflow run and hands it to the Codex CLI, which uses it for all OpenAI model calls (`gpt-astra`, `gpt-sol`, `gpt-sol-pro`, `gpt-terra`, `gpt-luna` — anything under the `openai/` provider).

A stored Codex credential also decides **which agent runs**: runs on an OpenAI model use the Codex CLI itself, rather than routing OpenAI calls through another agent. An `OPENAI_API_KEY` does the same. If your only stored credentials are Anthropic ones, or the run is billed through [Pullfrog Router](/billing#pullfrog-router), nothing changes.

If the credential refreshes during a run (OAuth refresh tokens rotate on use), Pullfrog automatically persists the new token back to its secret store. ChatGPT can still end the session behind it, on its own or when you log out of ChatGPT, and runs then fail until you re-run `npx pullfrog auth codex`.

The credential lives on the workflow runner's disk only for the duration of the job, in a location the agent itself cannot read. It's never written to your repository, your GitHub Actions secrets, or anywhere else outside the encrypted Pullfrog store.

## Troubleshooting

**Device-code auth not enabled.** If `codex login --device-auth` exits immediately with a message about enabling device-code auth, go to [https://chatgpt.com/#settings/Security](https://chatgpt.com/#settings/Security), enable it, then re-run `npx pullfrog auth codex` (the CLI offers an interactive retry).

**Expired or revoked credential.** Workflow logs include `CODEX_AUTH_JSON was rejected by OpenAI` or `Token refresh failed: 401`. ChatGPT ended the session behind the credential: it expired, you logged out of ChatGPT, or the refresh token was used somewhere else. Re-run `npx pullfrog auth codex`. A repo with its own credential keeps using it, so delete that copy when the CLI offers to.

## See also

* [BYOK](/keys) — bring your own provider keys for other models.
* [Models](/models) — all supported OpenAI models and other providers.
* [Pullfrog Router](/billing#pullfrog-router) — the no-keys alternative; billed at raw provider cost.