# CodexAgent logs in with OPENAI_API_KEY automatically

> Agno's CodexAgent fixes the HTTP 401 "Missing bearer or basic authentication" error on servers that only set OPENAI_API_KEY. A ChatGPT or other existing Codex login stays in place.

- Published: 2026-10-23
- Author: Ashpreet Bedi
- Categories: Changelog
- Canonical: https://www.agno.com/blog/codexagent-logs-in-with-openai-api-key-automatically
- Markdown: https://www.agno.com/blog/codexagent-logs-in-with-openai-api-key-automatically.md

Agno's `CodexAgent` now logs the Codex app-server in with `OPENAI_API_KEY` before it starts or resumes a thread, and before `compact()`. Earlier releases passed the key through the environment without a login, and the app-server answered HTTP 401.

Agno asks the app-server for its current account first. It logs in when there is no account or the account is an API key, and it leaves a ChatGPT or other login untouched. The Codex app-server writes the login to `auth.json` in `CODEX_HOME`.

We ran the real Codex app-server with an empty `CODEX_HOME`, a fake key and the network blocked (real output).

```text
# Earlier releases
account after connect: None
auth.json: absent

# This release
account after connect: apiKey
auth.json: OPENAI_API_KEY = sk-fake-agno-demo | auth_mode = apikey
```

Reading a ChatGPT account makes the app-server call OpenAI, so that case ran on `FakeAsyncCodex`, the stand-in SDK from the release's own test suite.

```text
# Earlier releases, key set, any login
thread_start

# This release, key set
no login:      account -> login -> thread_start
ChatGPT login: account -> thread_start
```

The key comes from the agent's `env`, then `client_options.env`, then the process environment. When the login fails, `CodexAgent` closes the client and raises a `RuntimeError` that shows `[redacted]` in place of the key.

See the [cookbook](https://github.com/agno-agi/agno/blob/main/cookbook/frameworks/codex/README.md), and learn more about [running Claude and Codex as services](https://docs.agno.com/tutorials/harnesses-as-a-service) in the documentation.