How to Install Codex CLI: Setup, Auth, and Sandbox Guide
In this article
OpenAI's Codex CLI brings the same AI assistance available inside ChatGPT into a local terminal session, where it can read repository structure, invoke shell commands, run tests, and operate within a sandboxed execution boundary. For developers already operating in agentic workflows, the practical question is not whether such a tool is useful but exactly how to configure it safely — the wrong launch directory or an overly permissive sandbox profile creates real exposure before a single prompt is sent.
Installation is a single command. What requires attention is the sequence of decisions that follow: which authentication path to use, which directory to trust, and which sandbox profile to apply on Windows.
Installation
The standalone installer for macOS and Linux:
curl -fsSL https://chatgpt.com/codex/install.sh | sh
The Windows PowerShell equivalent:
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
The Windows installer adds Codex to PATH automatically. Package-manager alternatives are brew install --cask codex and npm install -g @openai/codex, with the npm path requiring Node.js and the Homebrew path suiting a Brew-managed Mac environment. The standalone installer requires neither.
On first launch, Codex presents three authentication routes. Choosing between them has billing consequences:
| Sign-in Method | Billing Source | Best For |
|---|---|---|
| Sign in with ChatGPT | ChatGPT plan allowance (shared with web app) | Users on Free, Go, Plus, Pro, Business, Edu, or Enterprise plans |
| Sign in with Device Code | ChatGPT plan allowance (shared with web app) | SSH sessions, containers, or machines without a browser callback |
| Provide your own API key | OpenAI Platform account linked to that key | Users who want usage decoupled from a ChatGPT subscription |
The ChatGPT path prints an authentication URL in the terminal and attempts to open it in a browser. If the browser does not launch automatically, the URL can be pasted manually. Confirm the account displayed on the browser confirmation screen before proceeding, to avoid attaching usage to the wrong plan.
Workspace Trust and Sandbox Configuration
After authentication, Codex prints the directory it is about to trust and waits for confirmation. Trust allows project-local configuration, hooks, and execution policies to load from that path. Launching Codex from a system directory — the source material specifically flags System32 as a demonstration of what not to do — and then accepting the default trust prompt hands those policies to the wrong location. The correct procedure is to cd into the target repository before running codex.
On native Windows, Codex offers two sandbox modes. OpenAI's documentation designates the elevated mode — which requires approving an administrator prompt — as the preferred native setup. That mode applies lower-privilege sandbox users, filesystem boundaries, firewall rules, and local policy changes. A non-admin mode exists for machines where elevation is unavailable but provides weaker protection. This distinction matters in contexts where AI coding agents have already been demonstrated as hijack vectors; accepting a weaker sandbox to avoid an elevation prompt is a deliberate risk trade-off.
In-Session Commands and Update Cycle
Once workspace and sandbox are configured, slash commands govern ongoing operation:
/status— reports the active model, directory, account, and current settings/permissions— inspects or modifies read-only, workspace, or full-access profiles/model— selects the model and reasoning effort tier available to the account/init— generates anAGENTS.mdfile for repository-specific instructions/review— surfaces pending changes before they are committed/exit— terminates the session cleanly
The source material recommends starting with a read-only prompt — asking Codex to explain repository structure and list verification commands without modifying any files — to confirm the tool can see the repository before granting write or execution access. Running /init after that first verification embeds project-specific rules directly into the repository, avoiding the need to re-specify context in each session.
Updates reuse the identical install commands; OpenAI does not maintain a separate update path for standalone installs. Package-manager installs update through their respective managers: brew upgrade --cask codex or npm install -g @openai/codex@latest. Running codex --version after either method confirms the installed build.
The architectural pattern now visible in Codex CLI — a sandboxed execution layer, an explicit permissions model, and repository-scoped configuration files — mirrors the questions being raised across agentic AI system design more broadly: how much autonomy to grant by default, and where to draw the filesystem boundary. Getting those defaults wrong at installation time is considerably easier than correcting them after a tool has already touched production files.