Three auth paths — classic API key, paste-in tokens from `codex login`, or a full JSON-RPC bridge against `codex app-server`. The bridge path is the premium experience: tokens refresh automatically on the host, your Worker just forwards RPC. See the companion bridge recipe under `companion/codex-bridge/` for deployment options. Pair with `codex-bridge-worker` for a pure-Cloudflare flow where tokens live in a Durable Object and you rotate manually via `POST /auth/rotate`.

Install

1 · Config

Append to ENABLED_PLUGINS in wrangler.toml:

codex

Append to ALLOWED_HOSTS:

chatgpt.com,api.openai.com

2 · Secrets

Run each from your Worker project:

• wrangler secret put OPENAI_API_KEY optional — Classic API key path. Billed at OpenAI API rates.
• wrangler secret put CODEX_ACCESS_TOKEN optional — From ~/.codex/auth.json after `codex login`.
• wrangler secret put CODEX_ID_TOKEN optional — Same source; paired with access token.
• wrangler secret put CODEX_APP_SERVER_URL optional — URL of a running codex-bridge (ws:// or https://). Use the bridge worker's deployed URL.
• wrangler secret put CODEX_APP_SERVER_TOKEN optional — Bearer token the main Worker sends to the bridge. Must match the bridge's BRIDGE_TOKEN secret.

OPENAI_API_KEY=# optional — Classic API key path. Billed at OpenAI API rates.
CODEX_ACCESS_TOKEN=# optional — From ~/.codex/auth.json after `codex login`.
CODEX_ID_TOKEN=# optional — Same source; paired with access token.
CODEX_APP_SERVER_URL=# optional — URL of a running codex-bridge (ws:// or https://). Use the bridge worker's deployed URL.
CODEX_APP_SERVER_TOKEN=# optional — Bearer token the main Worker sends to the bridge. Must match the bridge's BRIDGE_TOKEN secret.

Tags

Related

• Anthropic (direct) — Claude Messages API with native tool-use streaming.
• Cloudflare AI Gateway — Many providers behind one plugin with BYOK via Secrets Store.
• OpenAI-compatible (direct) — Groq, Together, Ollama, vLLM, or anything speaking the OpenAI schema.