Skip to content
Gate

Codex

Route Codex through Gate to add prompt-injection scanning, audit, caching, and cost tracking. Your workflow does not change. Codex connects through a gate model provider in ~/.codex/config.toml. Create your Gate key (sk-gw-…) under API keys in the dashboard.

Pay through Gate

Use your Gate key as the only credential. Gate routes each request and bills your prepaid balance.

model_provider = "gate"


[model_providers.gate]
name = "Constellation Gate"
base_url = "https://gateway.constellationgate.ai/v1"
wire_api = "responses"


[model_providers.gate.http_headers]
"X-Gate-Api-Key" = "sk-gw-…your Gate key…"

Replace sk-gw-…your Gate key… with your own Gate key. Codex picks the model itself, so there is nothing to set here.

Use your own keys

Keep your ChatGPT subscription. Gate forwards your ChatGPT credential to OpenAI and adds its security and audit layer underneath. Codex reads the credential from a small helper script, so token refresh stays automatic.

model_provider = "gate"


[model_providers.gate]
name = "Constellation Gate"
base_url = "https://gateway.constellationgate.ai/codex"
wire_api = "responses"


[model_providers.gate.http_headers]
"X-Gate-Api-Key" = "sk-gw-…your Gate key…"
"X-Gate-Upstream-Url" = "https://chatgpt.com/backend-api"


[model_providers.gate.auth]
command = "/Users/you/.codex/gate-credential-helper.sh"

Run codex login once, then create the helper. It prints your ChatGPT OAuth bearer from ~/.codex/auth.json, and Codex calls it on every request. Use an absolute path in command (no ~).

cat > ~/.codex/gate-credential-helper.sh <<'EOF'
#!/bin/sh
set -eu
AUTH_FILE="$HOME/.codex/auth.json"
TOKEN=$(sed -n 's/.*"access_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$AUTH_FILE" | head -1)
[ -z "$TOKEN" ] && TOKEN=$(sed -n 's/.*"OPENAI_API_KEY"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$AUTH_FILE" | head -1)
printf '%s' "$TOKEN"
EOF
chmod +x ~/.codex/gate-credential-helper.sh

Gate Connect sets up this helper for you automatically.

Replace sk-gw-…your Gate key… with your own Gate key, and set command to your own absolute helper-script path.

Confirm requests are flowing

Restart Codex so it reads the new config.toml, then open the dashboard and use Codex the way you normally would. New requests appear on the Messages page within a few seconds, each with its model, cost, and security result.