Arnab's Notes

Setting up CLIProxyAPI for Codex

Properties1
tagstechnology

2 min read

CLIProxyAPI can expose a locally authenticated Codex account through an OpenAI-compatible API. This is the setup that worked for me on Linux.

Install and start CLIProxyAPI

Run the Linux installer from the CLIProxyAPI quick start:

curl -fsSL https://raw.githubusercontent.com/router-for-me/cliproxyapi-installer/refs/heads/master/cliproxyapi-installer | bash

Enable the user service so it starts automatically, start it immediately, then check its status:

systemctl --user enable cliproxyapi.service
systemctl --user start cliproxyapi.service
systemctl --user status cliproxyapi.service

Authenticate with Codex

Run the OAuth login flow and complete the browser authentication in `~/cliproxyapi/:

cli-proxy-api --codex-login

Configure CLIProxyAPI

Open ~/cliproxyapi/config.yaml. Add a management key, which is used to access the management interface at localhost:8317:

remote-management:
  allow-remote: false
  secret-key: "<management-key>"

Bind the proxy to the local machine and create an API key for Codex:

host: "127.0.0.1"
port: 8317
auth-dir: "~/.cli-proxy-api"
api-keys:
  - "<codex-api-key>"

Keeping host restricted to 127.0.0.1 and allow-remote disabled prevents the proxy and its management interface from being exposed to the network.

Restart the service after changing the configuration:

systemctl --user restart cliproxyapi.service

Configure Codex

Add the following to ~/.codex/config.toml. The bearer token must match the API key created in config.yaml.

model_provider = "cliproxyapi"
 
# Codex App voice chat requires these. Omit them if voice chat is not needed.
experimental_realtime_webrtc_call_base_url = "http://127.0.0.1:8317/v1"
experimental_realtime_ws_base_url = "http://127.0.0.1:8317/v1"
 
[model_providers.cliproxyapi]
base_url = "http://127.0.0.1:8317/v1"
experimental_bearer_token = "<codex-api-key>"
name = "OpenAI"
wire_api = "responses"
requires_openai_auth = false
supports_websockets = true

Restart Codex after changing its configuration. Requests should now pass through the local CLIProxyAPI instance at 127.0.0.1:8317.

Graph View