Set up Codex Gateway

Connect a ChatGPT Codex account, install the supported Gateway, and use Codex from a logical Model.

Codex Gateway lets an Agent perform model-completion turns through a tenant-authorized ChatGPT Codex account. It is an installable, Constal-managed package available to every tenant's Gateway catalog. Each installation is tenant-owned because it binds that tenant's Credential. The Gateway has no public inference endpoint; only an admitted Agent Resource invocation can reach it.

Before you begin

Have access to the ChatGPT account and workspace the Agent should use. You do not need to create the Credential separately: the Gateway wizard can install the managed Codex Device Flow provider, run authorization, and bind the resulting Credential. You can also select an existing compatible Codex Credential. Review OpenAI's Codex authentication guidance for account and workspace requirements.

Steps

1. Open Resources → Gateways and choose Add Gateway.
2. Select Codex Gateway from the managed catalog.
3. Enter a stable ID, such as team-codex, and a readable display name.
4. In Codex Credential, choose an existing Codex Credential or select Connect Codex.
5. If you connect an account, open the displayed OpenAI page, enter the one-time code, and authorize the intended ChatGPT workspace. Keep the wizard open while Constal checks completion.
6. When authorization completes, the saved Credential is selected automatically and the Gateway form resumes with your existing entries intact.
7. Choose Add Gateway.
8. Create a logical Model whose model ID is supported by the connected Codex account and whose fixed Gateway is the new installation.
9. Bind that logical Model to an Agent and start a controlled Run.

The Gateway sends the normalized Model request to the Codex Responses endpoint and translates streamed response events, Tool calls, and token usage back to Constal's model contract. It makes one upstream request for one invocation, does not hide 429, does not expose the access token to Agent code, and permits long requests within the platform's ten-minute Resource invocation limit.

This is a Constal-supported Codex integration, not an OpenAI Platform API-key Gateway. It follows the ChatGPT Codex protocol used by the Codex client and is versioned independently so upstream protocol changes can be validated before promotion.

Verify

Open the Run journal and confirm that the logical Model and exact Codex Gateway version were pinned at admission. A successful turn should record input, output, and cached token counts when reported upstream. If authorization is invalid, reconnect the Credential rather than pasting token material into Gateway settings. If upstream rate limits the account, the invocation should fail visibly with that status.

Next steps

Use Gateways and Models to understand why Agents bind logical Models, Add and manage Gateways for the general installation flow, and scoped bindings when a shared Agent must select a different authorized account for each customer or principal.