For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to the page URL.
Primary navigation

Suggested

Getting started

Feature Configuration

Identity and access

Deployment and configuration

ChatGPT Work

Collaboration and sharing

Plugins and connections

Usage and analytics

Security and compliance

API Dashboard
Try ChatGPT

FedRAMP workspace configuration

Configure the Codex app or CLI to use a FedRAMP ChatGPT workspace with Sign in with ChatGPT.

Shared responsibility

Your organization secures the devices running Codex, their credentials and local files, and any third-party services it enables. Codex’s network settings do not replace your device firewall.

Workspace baseline

The app and CLI share the recommended Baseline below.

OpenAI provides an initial baseline. Admins can edit it in Policies & Configurations. Admins should review and accept the risks for any features they enable.

Baseline requirements.toml
Baseline requirements.toml
# For the options available here, refer to:
# https://learn.chatgpt.com/docs/config-file/config-reference#requirementstoml

allowed_web_search_modes = ["cached"]
allowed_approvals_reviewers = ["user"]
allow_appshots = false
allow_remote_control = false
model_provider = "openai"

[feedback]
enabled = false

[features]
memories = false
external_agent_memory_import = false
chronicle = false

# Plugin sharing and recommendations. Note that enabled plugins may send user data
# to third-party services, e.g. the Slack plugin sends data to Slack.
# https://learn.chatgpt.com/docs/plugins
plugin_sharing = false
recommended_plugins = false
tool_suggest = false

# Interactive MCP apps and prompts to install skill dependencies. Enabled MCPs may receive user data.
enable_mcp_apps = false
skill_mcp_dependency_install = false

# Note that both browser use and computer use are up to your organization's risk appetite.
# An agent using your browser or computer may navigate to any websites or applications that the
# computer has access to. OpenAI does not currently provide additional protections restricting
# the network paths that browser use and computer use may exercise.
browser_use = false
browser_use_external = false
browser_use_full_cdp_access = false
in_app_browser = false
computer_use = false

image_generation = false
realtime_conversation = false
standalone_web_search = false

guardian_approval = false
guardianv2 = false
workspace_dependencies = false
hooks = false

[mcp_servers]

[marketplaces]
restrict_to_allowed_sources = true

[application.network]
enabled = true

[application.network.domains]
"gov.chatgpt.com" = "allow"
"auth.openai.com" = "allow"

# FedRAMP plugin bundle downloads.
"sdfedpreastus2.oaiusercontent.com" = "allow"

Plugins use the FedRAMP catalog. Workspace admins still control which plugins users can install and use through plugin settings and the Use Plugins permission. Add any domains approved plugins need to the allowlist. To turn off plugins for managed clients, add plugins = false under [features] in the baseline. Users cannot override this restriction in their local configuration.

The baseline keeps interactive MCP apps and separately configured or plugin-bundled MCP servers disabled. Hosted workspace apps use a separate runtime.

Configure network access for agent commands through command-network requirements.

Codex client

Verification checklist · Feature settings

Before you begin

This setup requires Codex app version 26.1002.51308 or later and a FedRAMP ChatGPT workspace with admin access to its policies and permissions.

1. Verify the workspace policy

  1. Select your FedRAMP workspace in ChatGPT, then open Policies & Configurations.
  2. Review and update the Baseline, then select Test policies to check which settings apply to a user and platform.
  3. Enable Codex Local access for your users. Workspace policy restrictions still apply.

For workspaces with both FedRAMP and HIPAA requirements, use the combined policy.

2. Configure the FedRAMP connection

Set these values in your user configuration before signing in:

forced_login_method = "chatgpt"
model_provider = "openai"
openai_base_url = "https://gov.chatgpt.com/backend-api/codex"
chatgpt_base_url = "https://gov.chatgpt.com/backend-api/"

Keep the built-in openai provider. openai_base_url routes model requests and the model catalog to Gov; chatgpt_base_url routes workspace policy, plugins, and other ChatGPT backend requests to Gov. These local settings are required even when the workspace supplies the baseline.

Fully quit and reopen the app after changing these settings. Sign-in opens your external browser, which may visit chatgpt.com and auth.openai.com. The app’s network policy does not restrict that browser. Token exchange and refresh still require the app to reach auth.openai.com.

Device requirements before sign-in

To enforce sign-in and network restrictions before the first workspace-policy fetch, deploy these settings in the system requirements.toml or through macOS MDM. Authentication requirements cannot be delivered through workspace policy.

allowed_login_methods = ["chatgpt"]
model_provider = "openai"

# Replace with your FedRAMP workspace ID.
allowed_chatgpt_workspaces = ["00000000-0000-0000-0000-000000000000"]
chatgpt_base_url = "https://gov.chatgpt.com/backend-api/"

[application.network]
enabled = true

[application.network.domains]
"gov.chatgpt.com" = "allow"
"auth.openai.com" = "allow"
"sdfedpreastus2.oaiusercontent.com" = "allow"
"chatgpt.com" = "deny"
"platform.openai.com" = "deny"
"api.openai.com" = "deny"
"gov.api.openai.com" = "deny"

See Managed configuration for file locations and MDM delivery. Prevent standard users from editing the policy file or its parent directory.

Optional diagnostic defaults

These config.toml defaults disable usage analytics and OpenTelemetry exports. Users can override them. Feedback remains disabled by the workspace policy.

[analytics]
enabled = false

[otel]
exporter = "none"
trace_exporter = "none"
metrics_exporter = "none"
log_user_prompt = false

Admins can configure an approved OpenTelemetry collector and its network access.

3. Sign in and verify

Select Continue to sign in, finish signing in through the browser, and select your FedRAMP workspace. You can verify your setup with synthetic data using the checklist below.

Check Expected result
Sign-in Your FedRAMP workspace is selected. If device sign-in restrictions are configured, API login and other workspaces are unavailable.
Workspace policy The assigned requirements are loaded, including feedback.enabled = false.
Local task Codex reads a test file, makes an approved edit, and completes a model request through the Gov backend.
Approvals and features Approval prompts and available features match the workspace policy.

The app may restart automatically when applying new network restrictions.

Troubleshoot common problems

Problem What to check
The workspace is unavailable Check workspace membership, Codex Local access, and any local workspace restrictions.
Sign-in succeeds but tasks fail Check the Gov backend URL, effective workspace policy, and required network destinations.
A feature is unavailable Check both workspace permissions and requirements. Allowing a network destination does not enable a feature.
Plugins do not appear after a policy change Verify the effective plugin policy, then fully quit and reopen the app.

Feature settings

Users cannot override feature settings enforced by requirements.toml.

The table summarizes the configuration above. On means permitted where supported; other permissions and network controls still apply. Not set means the baseline does not override that control; your workspace policies will apply.

Feature Default Notes
Local coding, files, Git, and subagents On —
Local scheduled tasks On —
Web search On (cached) Live search is blocked; users can turn search off. Command-network rules do not restrict hosted search.
Apps and plugins On Uses the FedRAMP catalog and the workspace’s Use Plugins permission. Plugin sharing, recommendations, and installation suggestions are off.
Browser Off Includes the built-in browser, connected browsers, agent browser control, and Developer mode.
Computer Use and Appshots Off —
Memory and Computer History Off —
Image generation Off Does not block image inputs or reading existing image files.
Configured MCP servers Off Admins can enable approved servers after accepting the risks for their use case and configuring access and network controls.
Interactive MCP apps Off —
Automatic approval review Off —
Remote control Off SSH connections are separate.
Dictation Not set —
Chat and desktop voice Not set Subject to workspace permissions and feature availability.
App updates Not set The baseline does not allow update-download destinations.