Codex ChatGPT Login vs API Key: CLI Auth, Billing & Access

Which surfaces accept each sign-in

The last column shows what an API key gives up: everything that runs in OpenAI's cloud or inside a ChatGPT workspace.

On Free and Go, OpenAI lists Codex in the desktop app, on GPT-6 Luna as it rolls out. It lists the CLI, the IDE extension and cloud tasks from Plus up.

How to sign in with an API key, check, and switch

In the Codex CLI, pipe the key in rather than typing it on the command line: printenv OPENAI_API_KEY | codex login --with-api-key. Plain codex login opens the ChatGPT sign-in in a browser, and codex login --device-auth (beta) gives a code to enter on another device when the machine has no browser. In the IDE extension, choose Use API Key instead of Sign in with ChatGPT; in the ChatGPT desktop app, choose Sign in another way and enter the key.

codex login status shows which method is active. To switch, run codex logout, which clears the stored credentials, and sign in again with the other method. The CLI and the IDE extension share one cached login in ~/.codex/auth.json or the operating system's credential store, so logging out in one means signing in again in the other. OpenAI does not document which credential wins when both an API key and a ChatGPT login are set up, so check the status before a long session. Admins can force one method with forced_login_method (chatgpt or api) and pin a workspace with forced_chatgpt_workspace_id.

Plan messages per five hours, API dollars per token

ChatGPT sign-in draws on one allowance that Codex shares with ChatGPT Work. OpenAI publishes ranges, not fixed limits. On Plus and Standard Business it estimates these local messages per five-hour window:

• GPT-6 Astra: 5 to 45
• GPT-6.1 Sol: 15 to 160
• GPT-6 Luna: 350 to 3,000

Weekly limits may also apply, and cloud tasks can use more of the allowance. Pro ($100, $200 or $500 a month) currently has no five-hour limit. In the CLI, /status shows what is left.

An API key pays per million tokens. GPT-6.1 Sol costs $2 for input and $10 for output, GPT-6 Astra $10 and $50, and GPT-6 Luna $0.10 and $0.50. Cached input is billed at a tenth of the input rate or less, and writing context into the cache costs 1.25 times the input rate. Image generation in Codex also moves to API pricing.

The bills meet in one place: when a ChatGPT plan hits its limit, any user can keep working locally by signing in with an API key. Those turns are charged to the API account, not the plan. No ChatGPT plan lists API credits, and an API balance never unlocks plan features.

Illustrative break-even: Plus versus GPT-6.1 Sol on the API

OpenAI warns that API prices do not estimate how many tasks a plan includes. They can still show when paying per token is cheaper. Assume one local turn sends 40,000 input tokens of code and context and returns 2,000 output tokens. That is an illustrative size, not an OpenAI figure.

At 200 turns a month the routes cost about the same. Twenty turns a day reaches 200 in two working weeks, so a daily Codex user is better off on Plus. A review script in your own CI that runs 30 times a month at the same illustrative size costs about $3 on the API, and it runs without a browser, which needs an API key or a workspace access token. Codex cloud's own GitHub code review is different: it runs on ChatGPT sign-in from Plus up and counts as Code Review usage on the plan. Cached context lowers the API figure for long sessions that resend the same files.

Automation: API key or workspace access token

OpenAI recommends API-key sign-in for programmatic Codex CLI work such as CI jobs. ChatGPT Enterprise also lets admins allow Codex access tokens for trusted scripts and private CI runners that need the workspace's Codex entitlements without a browser sign-in. OpenAI's feature table lists the tokens for Business too.

The sign-in also decides data handling. In a ChatGPT workspace, sign-in follows its permissions and, on Enterprise, its retention and residency settings. An API key follows the API organization's settings. API keys, Business and Enterprise do not train on your data by default. Plus and Pro do unless you opt out, so a shared repository is safer under a workspace or an organization key than under one person's plan.

For the prices behind each route, see Codex pricing and Codex credits vs API billing.