Codex
Sign Codex in with your ChatGPT plan or an OpenAI API key, and what it uses in your terminals, in guests' shells and on your cloud boxes.
Codex signs in with your ChatGPT plan by default. An OpenAI API key works too,
if you would rather pay per call. taiku uses the login codex already has.
Sign in with your ChatGPT plan
On your own computer:
codex loginIt opens the ChatGPT sign-in page and saves the login. codex login status
shows how you are signed in. A codex you start in a taiku terminal uses that
login, the same as in any other terminal. Calls count against your plan's usage
limits; when you hit one, Codex says so and names the reset time.
Use an API key instead
- Save the key as your login.
printenv OPENAI_API_KEY | codex login --with-api-keystores the key in place of the ChatGPT login. It is a saved login, so it works everywhere the ChatGPT one does, includingtaiku agent --local codexand cloud boxes. - Export the key in your shell startup file. Put
export OPENAI_API_KEY=...in~/.zshrcor~/.bashrc. taiku's shells run that file, so the key is there. A key you only exported in the terminal you started taiku from is not passed on. taiku keeps it out oftaiku agent --local, so an agent there never answers on an account you did not pick for it. It also stays out of a guest's sandboxed shell in the defaultisolatedmode, which does not run your startup files; atrustedsandboxed shell or one without the sandbox runs them, and gets the key.
Run it from taiku agent
taiku agent --local codexThis runs codex on this machine with its own saved login, inside taiku's
sandbox. An exported OPENAI_API_KEY is ignored here.
If it stops at once with agent stdout closed, the sandbox could not read your
Codex install. This happens when npm installs into a folder in your home
directory. Start it with taiku agent --local codex --no-sandbox instead.
Guests in your session
What a guest's shell gets from you depends on how it runs. Every sandboxed shell
the app opens for a guest on macOS or Linux runs in isolated mode.
| A guest's shell | Keys your startup files export | Your Codex login |
|---|---|---|
Sandboxed, isolated | No | No, whatever --agent-credentials says |
Sandboxed, trusted (not offered in the app) | Yes | With --agent-credentials own-or-host, for guests who have not signed in; with host, for everyone; with the default, own, no |
| Without the sandbox: Ignore sandboxing, a session whose default is no sandbox, or a Windows host | Yes | The shell runs as you and can read it. --agent-credentials decides which login codex starts on: yours with own-or-host for guests who have not signed in, and with host for everyone |
With the default, own, a signed-in guest runs codex on their own login, kept
in a folder of theirs on your machine, and a guest who has not signed in gets no
agent. See
Guests use their own agent logins
and Guests on your machine.
On a cloud box
Two ways to have codex signed in on a box:
-
Through your taiku account. On any computer with a browser:
taiku codex loginIt runs Codex's own sign-in in a folder of its own, so the login
codexalready has on that computer is left alone, and gives the new login to taiku. Every new shell you open on one of your Linux cloud boxes then starts withcodexsigned in to your ChatGPT plan. taiku keeps the login fresh and your shells borrow it, so no box holds a copy that could sign another one out. Once anyone else joins a session on a box, even just to watch, that box stops lending it for good. Settings → Agent → Codex on your cloud boxes shows whose login taiku holds, and Remove forgets it.Only the shells that borrow it send Codex through taiku, and
codexthere keeps your settings, sessions and history. Your Codex config is left as it is, sossh, cron and any shell that does not borrow the login keep using whatever login the box has of its own. If your config sends Codex somewhere else (openai_base_url,chatgpt_base_url, or amodel_providerother than OpenAI's), your shells on that box do not borrow the login. -
A login of the box's own. Without one on your account,
taiku cloudoffers to sign the box in to ChatGPT with a login of its own, opening the sign-in page on your computer. Your computer's login is not copied, so neither can sign the other out. A saved API key is copied as it is.
taiku cloud also copies your shell startup files (~/.zshrc, ~/.bashrc and
the like) when it opens a session on a box: the first time, and again whenever
one of them changes on your computer, the box's image changes or the box is
rebuilt. taiku cloud --refresh-agents copies again, and
taiku cloud --no-cloud-codex-auth leaves Codex's login behind for that run. An
API key exported in your startup files reaches the box with them.
Boxes taiku runs for you come with codex installed. On a machine you bring
over SSH, install it yourself.
Hosted agents
The agents you keep on your account do not use your ChatGPT plan. They call the model with an API key: the one this taiku holds, or your own under Settings → Agent → Model providers.
Claude Code
Sign Claude Code in with your Claude subscription or an Anthropic API key, and what it uses in your terminals, in guests' shells and on your cloud boxes.
Gemini CLI
Sign Gemini CLI in with your Google account or a Gemini API key, and what it uses in your terminals, in guests' shells and on your cloud boxes.