Arnab's Notes

Setting up CLIProxyAPI for Codex

Properties1
tagstechnology

2 min read

CLIProxyAPI can expose a locally authenticated Codex account through an OpenAI-compatible API. This is the setup that worked for me on Linux.

Warning

run the login command inside the directory where the config lives.

Install and start CLIProxyAPI

Run the Linux installer from the CLIProxyAPI quick start:

curl -fsSL https://raw.githubusercontent.com/router-for-me/cliproxyapi-installer/refs/heads/master/cliproxyapi-installer | bash

Enable the user service so it starts automatically, start it immediately, then check its status:

systemctl --user enable cliproxyapi.service
systemctl --user start cliproxyapi.service
systemctl --user status cliproxyapi.service

Authenticate with Codex

Run the OAuth login flow and complete the browser authentication in `~/cliproxyapi/:

cli-proxy-api --codex-login

Configure CLIProxyAPI

Open ~/cliproxyapi/config.yaml. Add a management key, which is used to access the management interface at localhost:8317:

remote-management:
  allow-remote: true
  secret-key: "<management-key>"

Bind the proxy to the local machine and create an API key for Codex:

host: "127.0.0.1"
port: 8317
auth-dir: "~/.cli-proxy-api"
api-keys:
  - "<api-key>"
transient-error-cooldown-seconds: 5

Keeping host restricted to 127.0.0.1 and allow-remote disabled prevents the proxy and its management interface from being exposed to the network.

Restart the service after changing the configuration:

systemctl --user restart cliproxyapi.service

Configure Codex

Add the following to ~/.codex/config.toml. The bearer token must match the API key created in config.yaml.

model_provider = "cliproxyapi"
 
# Codex App voice chat requires these. Omit them if voice chat is not needed.
experimental_realtime_webrtc_call_base_url = "http://127.0.0.1:8317/v1"
experimental_realtime_ws_base_url = "http://127.0.0.1:8317/v1"
 
[model_providers.cliproxyapi]
base_url = "http://127.0.0.1:8317/v1"
experimental_bearer_token = "<api-key>"
name = "OpenAI"
wire_api = "responses"
requires_openai_auth = false
supports_websockets = true

Restart Codex after changing its configuration. Requests should now pass through the local CLIProxyAPI instance at 127.0.0.1:8317.

Configure Claude Code

Add this environment variables:

export ANTHROPIC_AUTH_TOKEN="<api-key>"
export ANTHROPIC_BASE_URL="http://127.0.0.1:8317"
export ANTHROPIC_DEFAULT_FABLE_MODEL="claude-fable-5"
export ANTHROPIC_DEFAULT_OPUS_MODEL="claude-opus-5"
export ANTHROPIC_DEFAULT_SONNET_MODEL="claude-sonnet-5"
export ANTHROPIC_DEFAULT_HAIKU_MODEL="claude-haiku-4-5-20251001"

Tailscale

tailscale serve --bg --https=8317 http://127.0.0.1:8317

allow-remote needs to be true for this.

Graph View