Environment variables

Provides a ChatGPT or Codex access token for trusted automation. For persisted login, pipe it to `codex login --with-access-token`.

Provides an API key to a non-interactive Codex process. Set it inline rather than job-wide when running repository-controlled code.

Points to a PEM CA bundle for environments with corporate TLS interception or private root certificates. Takes precedence over `SSL_CERT_FILE`.

Sets the root for Codex state, including config, auth, logs, sessions, skills, and standalone package metadata. If you set it, the directory must already exist.

Changes where the visible `codex` command is installed. The standalone package cache still lives under `CODEX_HOME/packages/standalone`.

Set to `1`, `true`, or `yes` to skip installer prompts. Prompts use their default response, so use this for scripted installs and updates, not first-run setup.

Sets where SQLite-backed state is stored. The `sqlite_home` config option takes precedence. Relative paths resolve from the current working directory.

Selects the federation rule configured for the workload.

Points to the absolute path of the file that contains the current OIDC token or SPIFFE JWT-SVID.

Optionally supplies bounded JSON identifiers for client-reported audit attribution. It does not affect authentication or authorization.

Controls Rust log filtering and verbosity. `codex exec` defaults to `error` output unless you set a more verbose value.

Fallback PEM CA bundle path when `CODEX_CA_CERTIFICATE` is unset.