The codex provider talks to the ChatGPT backend with your subscription instead of an API key. No Codex CLI installation is needed.

zagent login
export AI_PROVIDER=codex
zagent models
export AI_MODEL=gpt-5.4  # select a model available to your account
zagent "Inspect this project"
zagent logout

Open the official device authorization URL printed by login in a browser on any device and enter the displayed code. Device authorization must be enabled for the account. This is an independent implementation of the official Codex protocol, not an OpenAI-published client.

/status shows the current model and the last turn's input/output tokens (server usage or local estimates). With AI_PROVIDER=codex, it also fetches ChatGPT subscription usage windows, showing used/remaining percentages and reset countdowns. Other providers' account quotas must be checked in their billing dashboards. This command does not make a model request; quota lookup failures do not interrupt the conversation.

models prints the server's original JSON, so pick a name from it with AI_MODEL.

ChatGPT credentials use https://chatgpt.com/backend-api/codex/responses and /models; they are not API keys for https://api.openai.com/v1. The existing openai provider continues to use separately billed API keys. The codex provider rejects custom AI_URL values and does not use AI_KEY for authentication.

Codex requests always stream, move system instructions into instructions, and omit the unsupported max_output_tokens field. Available models and limits depend on the account. Backend compatibility may change with the official client.

Tokens are stored separately in $HOME/.config/zagent/codex-auth.json with mode 0600. Access tokens are checked before requests and refreshed near expiration; rotated refresh tokens are saved. Do not share this file or run concurrent logins/refreshes against it. Run login again after a refresh failure. logout deletes local credentials without revoking the server grant. Existing Codex CLI credentials are untouched.

Set in the config file or the environment (environment wins):

AI_REASONING_EFFORT=high
AI_SERVICE_TIER=fast

AI_REASONING_EFFORT is a standard Responses field, so every provider sends it as the outer-level "reasoning":{"effort":"high"}. AI_SERVICE_TIER selects this backend's fast mode and is the Codex-only one, sent as "service_tier":"fast". AI_THINKING is DeepSeek's member: this backend does not define it and sends nothing unless the setting names it. When unset or empty the field is omitted. Whether a value is accepted is up to the model and the backend.

References: official authentication, official gateway routing.