Deploy Codex with Developer ChatGPT login

This guide is for IT admins deploying Codex on employee Macs, Windows machines, and Linux machines, where employees sign in to Codex with their own ChatGPT account. The managed settings in this guide route Codex API traffic through Chompute so usage is attributed and governed; no OpenAI API key is distributed to employees.

By the end of this guide, Codex on every managed machine will use the Chompute gateway with team attribution headers, while employees continue to authenticate normally with ChatGPT.

Prerequisites

Complete the following before pushing managed settings to employee machines. The first three are one-time setup in the Chompute admin console.

Create the Codex tool in the Chompute AI Control Plane.
Configure the provider attached to the Codex tool for Developer ChatGPT login. This tells Chompute to expect requests authenticated by an employee’s ChatGPT login, not by an OpenAI API key.
Create a Chompute Access Key for the Codex tool. Save it; you will paste it into the TOML below.
Decide the team value you want to attribute usage to (e.g. engineering, design, marketing). You can deploy different MDM profiles or configuration-management policies to different fleets so each machine carries the team it belongs to.
Confirm Codex is installed on the target machines. See the OpenAI Codex documentation.

Configuration

Codex reads managed settings from a TOML configuration. The same TOML payload is used on macOS, Windows, and Linux — only the delivery method and managed location change.

◇ managed_config.toml

01profile = "codex-chatgpt-chompute"02forced_login_method = "chatgpt"0304[profiles.codex-chatgpt-chompute]05model = "gpt-5.5"06model_provider = "chompute-chatgpt-auth-chompute"07model_reasoning_effort = "high"0809[model_providers.chompute-chatgpt-auth-chompute]10name = "Chompute - ChatGPT Auth"11base_url = "https://chompute-services.dragonfruit.ai/ai-gateway"12wire_api = "responses"13requires_openai_auth = true14supports_websockets = false15http_headers = { "X-Chompute-Access-Key" = "<CHOMPUTE_ACCESS_KEY>", "X-Chompute-Team" = "<TEAM>", "X-Chompute-Tool" = "Codex" }

Replace the angle-bracketed placeholders:

Placeholder	What to put	Example
`<CHOMPUTE_ACCESS_KEY>`	The access key you created in Chompute for the Codex tool.	`dfak_5a770f2a40c2...`
`<TEAM>`	Whatever team name you configure here gets captured and shown in Chompute Insights for attribution.	`engineering`

Note

X-Chompute-Tool: Codex is a literal value, not a placeholder. Leave it exactly as shown.

Warning

Do not set OPENAI_API_KEY in this TOML or anywhere on the machine for this deployment. In Developer ChatGPT login mode, Codex uses the employee’s ChatGPT login and forwards that auth through Chompute with requires_openai_auth = true.

Deploy with MDM

Push the managed configuration to every employee machine. Pick your platform below.

Note

Codex reads managed settings at startup and caches them. After the profile installs (or any time you push an update), employees must fully quit and relaunch Codex for the new configuration to take effect.

On macOS, Codex reads managed settings from the com.openai.codex managed preference domain. Push the TOML above as a base64-encoded string in config_toml_base64.

MDM profile

Create a custom macOS configuration profile in your MDM.
Preference Domain: com.openai.codex.
Add a string key named config_toml_base64.
Paste the one-line base64 value produced from managed_config.toml:
◇ terminal · macOS
```
$base64 -i managed_config.toml | tr -d '\n'
```

The final MDM payload should have this shape:

◇ macOS managed preference

$Preference domain: com.openai.codex$Key: config_toml_base64$Type: String$Value: <BASE64_ENCODED_MANAGED_CONFIG_TOML>

Scope the profile to a small pilot group first, then expand to the fleet.

Confirm the profile installed

On the target Mac, run:

◇ terminal · macOS

$profiles show -type configuration | grep -A30 com.openai.codex

Note

Keep Chompute provider and routing settings in managed_config.toml. For admin-enforced security policy that users cannot override, deploy a separate requirements.toml at the matching managed location (MDM key requirements_toml_base64 on macOS, %ProgramData%\OpenAI\Codex\requirements.toml on Windows, /etc/codex/requirements.toml on Linux). Use it to pin:

approval_policy and sandbox_mode — lock employees to the approval and sandbox modes you allow.
MCP server allowlist — restrict which MCP servers Codex can enable, by name and identity.
[rules] command rules — enforce prompt or forbidden decisions on shell command patterns (merges with project .rules; most-restrictive wins).
Managed lifecycle [hooks] — point managed_dir at scripts delivered by your MDM. Set allow_managed_hooks_only = true to ignore user, project, and session hooks.
web_search constraint — pin whether Codex’s built-in web search is allowed.

Test locally

Before scoping the managed profile or configuration policy to the fleet, validate the payload on one machine you control. This catches TOML mistakes and confirms Codex is reading the managed settings.

Fully quit Codex before writing the managed file, and relaunch it afterwards so it picks the new configuration up at startup.

Open Terminal, write the managed preference locally, then restart Codex:

◇ terminal · macOS

$cat > /tmp/chompute-codex-managed_config.toml <<'EOF'$profile = "codex-chatgpt-chompute"$forced_login_method = "chatgpt"$$[profiles.codex-chatgpt-chompute]$model = "gpt-5.5"$model_provider = "chompute-chatgpt-auth-chompute"$model_reasoning_effort = "high"$$[model_providers.chompute-chatgpt-auth-chompute]$name = "Chompute - ChatGPT Auth"$base_url = "https://chompute-services.dragonfruit.ai/ai-gateway"$wire_api = "responses"$requires_openai_auth = true$supports_websockets = false$http_headers = { "X-Chompute-Access-Key" = "<CHOMPUTE_ACCESS_KEY>", "X-Chompute-Team" = "<TEAM>", "X-Chompute-Tool" = "Codex" }$EOF$$defaults write com.openai.codex config_toml_base64 -string "$(base64 -i /tmp/chompute-codex-managed_config.toml | tr -d '\n')"

Then validate the payload decodes and send a test prompt:

◇ terminal · macOS

$defaults read com.openai.codex config_toml_base64 | base64 -d$codex exec "Reply with the single word: chompute"

Note

This local test writes to the user preference domain — it verifies that Codex parses the TOML and routes traffic through Chompute. It does not replicate a true MDM-managed preference, which has higher precedence and cannot be overridden by the user. To test enforcement, install the MDM profile on a pilot device.

Note

If the TOML is malformed, Codex can fall back to local or default settings. Always validate the payload on a pilot machine before relying on Chompute Insights to confirm the rollout.

Validate the rollout

On a machine with managed settings installed, run the following to confirm Codex is talking to Chompute and that usage is attributed to the right team.

Quit and relaunch Codex so it re-reads managed settings.

Confirm the effective managed intent. This is what your managed_config.toml resolves to once Codex applies it — verify your settings encode the same shape:

◇ effective Codex configuration

$Profile          codex-chatgpt-chompute$Provider         chompute-chatgpt-auth-chompute$Base URL         https://chompute-services.dragonfruit.ai/ai-gateway$Auth             ChatGPT login (requires_openai_auth = true)$Wire API         responses$Custom headers   X-Chompute-Access-Key, X-Chompute-Team, X-Chompute-Tool

Send a test prompt to confirm the round trip works:
◇ terminal
```
$codex exec "Reply with the single word: chompute"
```
Open the Insights tab in Chompute. You should see the test request, attributed to the team value from your managed config. Ingestion can take a few minutes — if the request isn’t visible yet, wait a moment and reload.

FAQ

What if Codex still does not use Chompute?

Confirm the managed config installed at the path for the employee’s platform, then fully quit and relaunch Codex. On macOS, confirm the MDM profile exists under com.openai.codex and that config_toml_base64 contains a valid base64 TOML payload.

What if Chompute returns an authorization error?

Confirm X-Chompute-Access-Key is present in the managed TOML and that the key belongs to the Codex tool in Chompute. Access keys are scoped per tool.

What if usage appears without team attribution?

Confirm X-Chompute-Team is present in the managed TOML and matches the team name you expect to see in Chompute Insights.

Will employees still see the ChatGPT login flow?

Yes. That is expected for Developer ChatGPT login. Employees still authenticate with ChatGPT; the managed settings route Codex traffic through Chompute after login.

Should the Chompute provider go in requirements.toml?

No. Keep routing and provider settings in managed_config.toml. Use requirements.toml only for extra enforced policy such as sandbox, approval, or web-search constraints.