sitdraw

How to install and use OpenAI Codex CLI: sign-in, first coding task, sandbox and safety

Install Codex CLI, sign in, run your first small approved change in a project folder, and keep workspace-write sandbox defaults.

To run your first job with OpenAI Codex CLI, finish four steps: official install, sign in (ChatGPT or API key), launch codex in a repo, then approve a small change inside sandbox defaults.

Facts follow developers.openai.com/codex Authentication, Sandbox, and Permissions plus GitHub openai/codex Quickstart. Queries: Codex CLI install, OpenAI Codex sandbox workspace-write. For a short huddle see sitdraw and create and join a room.

InstallSign inFirst task · sandbox

CLI vs IDE extension

Codex CLI

Runs in your terminal against the current working tree—handy for SSH remotes and editor-free workflows.

Shared login

CLI and IDE extension share cached credentials; logging out of one requires signing in again on the other.

workspace-writeSandbox
on-requestApprovals
/permissionsLive policy
GoalEntryFirst-hour check
Installinstall.sh / npm / Homebrewcodex starts
Sign inSign in with ChatGPT or API keyActive session; protect ~/.codex/auth.json
First coding taskPrompt in repo rootApprove diff → verify with git diff
Sandboxconfig.toml or flagsNot danger-full-access by default

Install, sign in, first task, safety defaults

  1. 01
    Install Codex CLI

    macOS/Linux: curl -fsSL https://chatgpt.com/codex/install.sh | sh. Windows: official PowerShell one-liner. Or npm install -g @openai/codex, brew install --cask codex.

  2. 02
    Sign in

    Run codex → Sign in with ChatGPT (browser OAuth) or API key per developers.openai.com/codex/auth. Never commit auth.json.

  3. 03
    First coding task

    cd your project root. Ask Codex for a one-line README tweak or comment-only change; Approve each step; confirm with git diff.

  4. 04
    Sandbox and approvals

    Set sandbox_mode = "workspace-write" and approval_policy = "on-request", or --sandbox workspace-write --ask-for-approval on-request. Install bubblewrap on Linux/WSL; type /permissions to inspect. Read every shell command before approving.

# First hour · OpenAI Codex CLI · 2026-09
# curl -fsSL https://chatgpt.com/codex/install.sh | sh
# npm install -g @openai/codex · brew install --cask codex
# codex → Sign in with ChatGPT
# cd my-repo && codex · workspace-write · on-request approvals
# Linux/WSL: bubblewrap (bwrap)
# developers.openai.com/codex · github.com/openai/codex
Compare Cline or Gemini CLI?
Codex CLI is OpenAI’s terminal agent; see our Cline guide and Gemini CLI guide.
Missing bwrap on Linux?
Install the distro bubblewrap package; see Sandbox docs for WSL2 notes.
ChatGPT vs API key?
ChatGPT sign-in for daily use; API keys for CI—never in public shells.
Whiteboard?
No—open sitdraw for diagrams.

Sandbox first, then Approve

Keep the first task to one small diff; treat terminal commands and auth.json as sensitive.

Start the picture