For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Configure Codex to use agentgateway running in Kubernetes

Configure Codex, the AI coding tool by OpenAI, to route requests through agentgateway running in Kubernetes.

Before you begin

1. Set up an agentgateway proxy.
2. Set up access to the OpenAI LLM provider.
3. Install either the Codex CLI or the ChatGPT desktop app.

Set the gateway URL

The installation quickstart sets INGRESS_GW_ADDRESS to the Gateway address. Set the Codex base URL from that value. The /v1 suffix is required because Codex sends Responses API requests to /v1/responses.

export AGENTGATEWAY_BASE_URL="http://${INGRESS_GW_ADDRESS}/v1"

If the route requires a virtual key, make the client key available to Codex. This value authenticates the client to agentgateway; it is not the OpenAI provider key that agentgateway sends upstream.

export AGENTGATEWAY_API_KEY='<gateway-client-key>'

Verify gateway connectivity

Follow Step 4 of the OpenAI quickstart to verify that the configured Gateway can reach the LLM provider.

Connect Codex to agentgateway

Codex CLI

Point Codex at agentgateway through one of the following methods.

codex -c 'model_provider="agentgateway"' \
  -c 'model_providers.agentgateway.name="OpenAI via agentgateway"' \
  -c "model_providers.agentgateway.base_url=\"${AGENTGATEWAY_BASE_URL}\"" \
  -c 'model_providers.agentgateway.wire_api="responses"'

mkdir -p ~/.codex
cat > ~/.codex/agentgateway.config.toml <<EOF
model_provider = "agentgateway"

[model_providers.agentgateway]
name = "OpenAI via agentgateway"
base_url = "${AGENTGATEWAY_BASE_URL}"
wire_api = "responses"
EOF

codex --profile agentgateway

Choose a client authentication method

Codex supports the following authentication methods for a custom model provider. Choose one method; do not combine them.

Unlike Claude Desktop, a Codex custom provider does not have native settings for an arbitrary OIDC issuer, client ID, or browser-versus-broker flow. To send a Microsoft Entra ID token, an organization-owned command-backed helper must acquire and refresh the token. This is not a built-in Intune or Company Portal flow in Codex.

For the gateway client key option, add the following field to the model_providers.agentgateway table in the profile, user configuration, or CLI overrides. Codex sends the value of that environment variable as the gateway credential.

env_key = "AGENTGATEWAY_API_KEY"

For the supported custom-provider authentication fields and restrictions, see Codex authentication and the Codex configuration reference.

Verify the CLI connection

1. Send a test prompt through agentgateway. For the profile configuration, include the profile name:

   codex --profile agentgateway "Hello"

2. Verify that the request appears in the agentgateway proxy logs.

   kubectl logs deployment/agentgateway-proxy -n agentgateway-system --since=5m \
     | grep 'http.path=/v1/responses' \
     | tail -n 5

   A successful entry has http.status=200 and http.path=/v1/responses.

For more configuration options, see the Codex CLI documentation.

Codex in the ChatGPT Desktop App

Codex is available in the ChatGPT desktop app. To use the same provider configuration with the app, back up and replace the user-level configuration, then restart the ChatGPT desktop app:

cp ~/.codex/config.toml ~/.codex/config.toml.bak
cat > ~/.codex/config.toml <<EOF
model_provider = "agentgateway"

[model_providers.agentgateway]
name = "OpenAI via agentgateway"
base_url = "${AGENTGATEWAY_BASE_URL}"
wire_api = "responses"
EOF

To edit the file through the app instead, open Settings > Configuration > Open config.toml and apply the same provider configuration.

Verify the app connection

1. Send a task from Codex in the ChatGPT desktop app.

2. Verify that the request appears in the agentgateway proxy logs.

   kubectl logs deployment/agentgateway-proxy -n agentgateway-system --since=5m \
     | grep 'http.path=/v1/responses' \
     | tail -n 5

   A successful entry has http.status=200 and http.path=/v1/responses.

For more information, see the Codex app documentation and Codex configuration basics.

Codex also probes /v1/models to discover model metadata. Until agentgateway issue #1462 adds a gateway-generated model list, Codex may warn that model metadata is not found. That warning does not prevent /v1/responses traffic from routing.

Next steps