Codex CLI setup: a custom provider profile for apiToken.sale

Codex CLI does not need a ChatGPT account

Codex CLI authenticates however its active model provider tells it to. Define a custom provider in a model_providers table, export the API key that provider names, and Codex never looks at the ChatGPT login in auth.json — every request is signed with your key and billed by whoever owns the endpoint. Point that endpoint at apiToken.sale and each session draws on one prepaid balance, metered at official OpenAI token rates with a flat 50% B2C discount applied.

The clean way to do this is a named profile rather than editing your main configuration. The profile lives in its own file, your default Codex setup and any existing ChatGPT login stay exactly as they were, and you opt in per run with a single flag. Delete the file and nothing about your environment remembers apiToken.sale existed.

See also: OpenAI-compatible API quickstart: from curl to the official SDK

Write the apitoken profile once

Run one command. It writes ~/.codex/apitoken.config.toml, backs up an existing file, and imports every OpenAI model enabled for your customer key.

curl -fsSL https://apitoken.sale/setup/connect.sh | bash

# Windows PowerShell
irm https://apitoken.sale/setup/connect.ps1 | iex

Two lines carry the security posture. env_key names a variable instead of storing the secret, so the key lives in your shell and never in a file you might commit. And base_url keeps its /v1 suffix — dropping it is the single most common cause of a broken first run, because every route Codex calls hangs off that prefix.

Keep wire_api = "responses". Current Codex 0.153 accepts the Responses wire. The gateway also serves Chat Completions for other clients, but that does not make wire_api = "chat" valid in Codex.

Export the key, check the catalog, run

1. 01Start the private apitoken-codex launcher printed by the setup. It loads the key only for that process.
2. 02Confirm what is enabled before you guess model IDs: curl https://router.apitoken.sale/v1/models with the same Bearer key returns the live catalog.
3. 03Launch with the profile flag: codex --profile apitoken. Passing the flag explicitly removes any ambiguity about which provider — and which env var — is active for the session.
4. 04Send one small prompt first. A clean answer proves the key, the base_url and the balance in a single round trip; a failure at this stage is cheap to diagnose.

curl -fsSL https://apitoken.sale/setup/connect.sh | bash

# The setup prints the launcher and the complete key-scoped model list.

The catalog endpoint answers for the whole gateway, not just GPT: the unified catalog namespaces IDs by provider (anthropic/*, openai/*, google/*). The same key and balance cover supported Claude, Gemini and Kimi models too — Codex will only ever call the provider its profile points at.

Pick the right GPT-5.6 tier for the session

The model line in the profile is your default, not a commitment — edit it per project. The three GPT-5.6 tiers exist because agentic coding burns tokens at very different rates depending on how hard the reasoning is:

• Sol's temporary official input/cached/cache-write/output rates are $4/$0.40/$5/$20 through 2026-11-21 inclusive, or $2/$0.20/$2.50/$10 after the flat 50% discount. Standard $5 input and $30 output return on 2026-11-22 UTC.
• gpt-5.6-sol for the hardest work: multi-file refactors, subtle debugging, anything where a wrong answer costs more than the tokens.
• gpt-5.6-terra as the daily driver — the tier most Codex sessions should default to.
• gpt-5.6-luna for fast cheap steps: boilerplate, renames, throwaway scripts, and high-volume loops where latency matters more than depth.
• Cached input is where agentic loops save real money — repeated context reads bill at the cached rate, then the 50% discount comes off on top.

Full per-model specs and discounted prices →

The four errors Codex will actually show you

• Missing APITOKEN_API_KEY — the variable named by env_key is not exported in the shell that runs codex. Export it in that same shell, or in your shell profile, and retry.
• stream error: unexpected status 401 — the key is wrong, revoked, or the base_url lost its /v1 suffix. Reproduce the call with curl outside Codex to isolate which half is broken.
• stream error: unexpected status 404 — the model ID is not enabled. Check GET https://router.apitoken.sale/v1/models instead of assuming the ID you typed exists.
• 402 — the shared prepaid balance needs a top-up. Backoff will not fix it; add balance and the next request succeeds.

All four are configuration or balance problems, not model problems — none of them is solved by retrying the same command. The 401 in particular almost always reduces to the /v1 suffix or an extra character pasted into the key.

The full Codex error playbook — config.toml, auth.json, stream errors →

What a Codex session costs on prepaid balance

Billing is per token at official OpenAI rates, with your flat 50% B2C discount subtracted before the charge touches the prepaid balance — the same rule that applies to Claude usage on the platform. There is no subscription and no seat fee: an idle week costs nothing, and a heavy session costs exactly the tokens it consumed at half the official spend.

Because the balance is shared across supported Claude, GPT, Gemini and Kimi models, Codex sessions draw from the same pool as everything else you run. Watch usage in the dashboard, and treat a 402 as the signal it is — the meter ran out, nothing else broke.

GPT-6 Astra: latest GPT model

GPT-6 Astra is the latest GPT model in this model catalog. Official fresh/cached/cache-write/output rates are $10/$1/$12.50/$50 per 1M tokens, or $5/$0.50/$6.25/$25 after the flat 50% B2C discount. Codex supports 872K maximum context, 744K conservative input and 128K output. Reasoning efforts are low, medium, high, xhigh and max. Above 272K input, input/cache rates double and output is 1.5×; Fast doubles the applicable rates. The GPT-5.6 examples below retain their own rates.

GPT-6 Astra →

Frequently asked questions

Related guides