OpenAI (Codex OAuth)

Codex OAuth uses Rho-owned OAuth and signs in with an OpenAI account subscription rather than an API key. For shared concepts such as credential storage and model selection, see authentication and models.

At a glance

Setting	Value
Provider	openai-codex
Auth	codex
Environment override	CODEX_ACCESS_TOKEN
API base	https://chatgpt.com/backend-api/codex
Model list	Static allowlist maintained by Rho

Sign in

/login openai-codex

/login openai-codex asks whether to use a browser callback or device-code, even when a browser is available. The default option is browser on a graphical session and device-code when headless. Either choice always shows the authorize URL. rho login openai-codex still auto-selects: it opens a browser when one can appear, and uses device-code when headless. --device-auth forces device-code on a graphical session.

Credentials are stored in the configured credential store, not in config or transcripts.

Device-code authorization

Device-code access is managed by OpenAI. See Codex authentication for current setup and troubleshooting guidance. If device-code login is unavailable for the account or managed workspace, use the regular browser callback instead:

rho login openai-codex

Sign out

/logout openai-codex

/logout openai-codex deletes stored Codex tokens. If an environment override is still present, the provider stays available.

Environment override

CODEX_ACCESS_TOKEN=...
CODEX_ACCOUNT_ID=... # optional for Codex

Environment variables are CI/development escape hatches and override stored credentials. For normal interactive setup, prefer /login.

Models

Codex OAuth uses this static model allowlist rather than a refreshable API list:

• gpt-6-astra (default; reasoning effort low through max)
• gpt-5.6-sol
• gpt-5.6-terra
• gpt-5.6-luna
• gpt-5.5
• gpt-5.3-codex-spark

GPT-5.4 and GPT-5.4 mini retired from Codex on August 31, 2026. If your saved Codex configuration uses either model, switch to gpt-5.6-terra or gpt-5.6-luna, respectively. OpenAI API access is unaffected.

Switch to a Codex model with:

/model openai-codex/gpt-5.6-sol

For a non-interactive run, pass the matching provider, auth mode, and model. These flags also update the persistent default:

rho --provider openai-codex --auth codex --model gpt-5.6-sol run "hello"

Run rho login openai-codex first or provide CODEX_ACCESS_TOKEN in the automation environment.

Supported GPT-5.5, GPT-5.6, and GPT-6 Astra Codex models can use OpenAI's faster priority tier at a higher credit rate. In the TUI, use /fast on or /fast off. Running /fast with no argument toggles the mode. Rho saves the choice as model.fast_mode, shows (fast) after the active model name, and sends service_tier: "priority" on later supported Codex turns.

/fast is the same command for every provider that has a fast mode. Codex implements it as the priority tier above. xAI OAuth grok-4.7 keeps that model selected and sends grok-4.7-build-fast instead of a service-tier header.

Notes

• Switching between Codex models preserves encrypted compaction items without changing stored history.
• Handoff warnings can still repeat after compaction: raw reasoning and other native items require the exact model, including the reasoning-effort record saved by gpt-6-astra compaction.
• On gpt-6-astra, /reasoning changes are sent as configuration_update items so the prompt cache prefix is preserved.
• As a subscription auth mode, the statusline estimates an equivalent API cost from models.dev pricing (including long-context rate tiers when available) and labels it (sub).
• /limits reports the usage windows for Codex OAuth when you are logged in.
• Context windows come from cached model metadata. Set usable_context_window in ~/.rho/models.toml to raise or cap a model. See local model metadata.

Mid-turn steering (gpt-6-astra)

On gpt-6-astra over the Codex websocket, steering entered during a model turn is forwarded as response.steer. The original response ends incomplete with reason steered (or completes if it finished first). The server then continues automatically with the steer prepended; Rho reuses that continuation instead of sending another response.create. Already-streamed text is not rewritten. If the original turn ended waiting for a client tool result, Rho replays a full next request so the server does not prepend an orphaned steer.

Steering is queued in the TUI as today. When the backend accepts it mid-turn, the pending-input row shows delivered until the steer is applied at the turn boundary. Disconnecting the websocket drops any unacked steer; Rho then applies it locally on the next step.

Async tool calling (gpt-6-astra)

On gpt-6-astra (OpenAI API and Codex), Rho advertises "async": true on function tools that declare async execution. The model may keep working after issuing that call; Rho delivers function_call_output later on the original call_id. Hosted built-in tools never get the flag. v1 only marks the agent tool.

OpenAI documents "async": true on output function_call items. When Rho replays that call in a later input array (storeless full history, not a previous_response_id delta), it also stamps "async": true on the input item so the server still treats the call as async. That input-side flag is an extrapolation from the output shape.