For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to the page URL.
Primary navigation

Suggested

Getting started

Feature Configuration

Identity and access

Deployment and configuration

ChatGPT Work

Collaboration and sharing

Plugins and connections

Usage and analytics

Security and compliance

API Dashboard
Try ChatGPT

FedRAMP API configuration

Configure local Codex workflows with a FedRAMP API key

Connect the Codex app or CLI to Gov API with a FedRAMP API key.

To sign in with ChatGPT, follow the FedRAMP workspace guide.

This guide is not legal advice and does not grant an authorization to operate (ATO). Review the configuration, enabled services, endpoint controls, and data flows with your security and authorizing officials against your agency’s requirements and system security plan.

Shared responsibility

Your organization secures the devices running Codex, including credentials, repositories, local records, and enabled third-party services. This configuration sends model requests to gov.api.openai.com and retrieves the model catalog from gov.chatgpt.com.

The provided configuration blocks features by default. Administrators can enable supported features after reviewing and accepting the risks for their use case and configuring the corresponding network controls.

Codex client

Verification checklist · Feature settings

Before you begin

Use desktop app version 26.1002.51308 or later, as shown in About.

Prepare What you need
API access A FedRAMP API key with access to your selected model at gov.api.openai.com.
Configuration A reviewed requirements.toml and approved network destinations.
Device management System configuration or MDM access to the machine running Codex.

1. Deploy device requirements

Deploy requirements.toml through system configuration or MDM before app launch or authentication. Follow Managed configuration for file locations and MDM delivery. Protect the managed policy and verify its settings on the machine running Codex in step 3.

The default requirements.toml below is intentionally restrictive. Administrators can enable supported features after reviewing and accepting the risks for their specific use case and configuring the corresponding network controls. Reference the feature docs and network control docs.

requirements.toml
# Disable ChatGPT sign-in.
allowed_login_methods = ["api"]

# https://learn.chatgpt.com/docs/agent-approvals-security#common-sandbox-and-approval-combinations
allowed_sandbox_modes = ["read-only", "workspace-write"]

# Approval prompts are reviewed by the user.
allowed_approvals_reviewers = ["user"]
allowed_approval_policies = [
{ granular = { sandbox_approval = false, rules = true, mcp_elicitations = false, request_permissions = false, skill_approval = true } },
]

# Allow cached search only when supported and approved for your deployment.
allowed_web_search_modes = ["disabled", "cached"]

# Block agent browser use and native-app control.
allow_browser_and_computer_use = false

# Appshots: https://learn.chatgpt.com/docs/appshots
allow_appshots = false

# Remote control: https://learn.chatgpt.com/docs/remote-connections#pick-up-work-from-another-device
allow_remote_control = false

# Managed hooks: https://learn.chatgpt.com/docs/enterprise/managed-configuration#enforce-managed-hooks-from-requirements
allow_managed_hooks_only = true

check_for_update_on_startup = false

# MCP servers, apps, and plugins are disabled by default.
# Admins can enable supported integrations after accepting the risks
# for their use case and configuring access and network controls.
# https://learn.chatgpt.com/docs/enterprise/managed-configuration
mcp_servers = {}

model_provider = "fedramp"

[model_providers.fedramp]
name = "OpenAI"
base_url = "https://gov.api.openai.com/v1"
model_catalog_url = "https://gov.chatgpt.com/backend-api/codex/models"
requires_openai_auth = true
supports_websockets = true
supports_standalone_web_search = true

[features]
apps = false
enable_mcp_apps = false
plugins = false

# Enable the network proxy for sandboxed commands.
# https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation
network_proxy = true

in_app_dictation = false
realtime_conversation = false

# Browser controls: https://learn.chatgpt.com/docs/enterprise/managed-configuration#disable-codex-feature-surfaces
# Note that both browser use and computer use are up to your organization's risk appetite.
# An agent using your browser or computer may navigate to any websites or applications that the
# computer has access to. OpenAI does not currently provide additional protections restricting
# the network paths that browser use and computer use may exercise.
in_app_browser = false
browser_use = false
browser_use_external = false
browser_use_full_cdp_access = false

# Computer Use: https://learn.chatgpt.com/docs/computer-use
# Enable after accepting the risks and configuring app and network access.
computer_use = false

# Set to true to let users update through the app.
# App-store, package-manager, and MDM updates are controlled separately.
# https://learn.chatgpt.com/docs/enterprise/manage-app-updates#turn-off-in-app-updates
in_app_updates = false

image_generation = false

# Memories: https://learn.chatgpt.com/docs/customization/memories
memories = false

# Computer History: https://learn.chatgpt.com/docs/customization/computer-history
chronicle = false

external_agent_memory_import = false

# We recommend that users review approval requests themselves.
# Admins can enable automatic review after accepting the risks for their use case.
# https://learn.chatgpt.com/docs/agent-approvals-security#automatic-approval-reviews
guardian_approval = false
guardianv2 = false

# Disable background skill-search experiments.
skill_search = false

# Hooks: https://learn.chatgpt.com/docs/hooks
hooks = false

# If you enable web search, use cached search through Gov API
# only when supported and approved for your deployment.
standalone_web_search = false

# Disable feedback submissions to OpenAI.
[feedback]
enabled = false

# Network controls for agent commands:
# https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-network-access-requirements
[experimental_network]
enabled = true
managed_allowed_domains_only = true

# No domains allowed by default. Add destinations approved for your use case.
domains = {}

# Add approved Unix socket paths here.
unix_sockets = {}

# Set to true when using an organization-approved upstream proxy.
allow_upstream_proxy = false

# Keep the command proxy bound to localhost.
dangerously_allow_non_loopback_proxy = false
dangerously_allow_all_unix_sockets = false

# Local/private networking: https://learn.chatgpt.com/docs/agent-approvals-security#local-and-private-destinations
allow_local_binding = false

# App network controls: https://learn.chatgpt.com/docs/enterprise/managed-configuration#control-desktop-app-network-destinations
[application.network]
enabled = true

[application.network.domains]
"gov.api.openai.com" = "allow"
"gov.chatgpt.com" = "allow"

# Other OpenAI and ChatGPT endpoints.
"api.openai.com" = "deny"
"chat.openai.com" = "deny"
"chatgpt.com" = "deny"
"ab.chatgpt.com" = "deny"
"platform.openai.com" = "deny"
"auth.openai.com" = "deny"
"sdfedpreastus2.oaiusercontent.com" = "deny"
"o33249.ingest.us.sentry.io" = "deny"
"persistent.oaistatic.com" = "deny"
"oaisidekickupdates.blob.core.windows.net" = "deny"

# Windows only: https://learn.chatgpt.com/docs/config-file/config-reference#requirementstoml
[windows]
allowed_sandbox_implementations = ["elevated"]

2. Configure provider routing and network controls

Set your model and Gov API URL before signing in. Put the settings below in your user or system config.toml. Users can change these defaults within the limits set by requirements.toml.

Keep the API key outside the TOML file and supply it through your organization’s approved secret-management process.

config.toml
# Replace with your approved FedRAMP API model ID.
model = "gpt-5.6-terra"
model_provider = "fedramp"
approval_policy = { granular = { sandbox_approval = false, rules = true, mcp_elicitations = false, request_permissions = false, skill_approval = true } }
sandbox_mode = "workspace-write"

# Set to "cached" only when supported and approved for your deployment.
web_search = "disabled"

[sandbox_workspace_write]
# Command destinations are controlled by requirements.toml.
network_access = true

# Disable sending Codex usage analytics to OpenAI.
[analytics]
enabled = false

# OpenTelemetry exports are off by default.
# Admins can configure an approved collector for logs, traces, and metrics.
# https://learn.chatgpt.com/docs/config-file/config-advanced#observability-and-telemetry
[otel]
exporter = "none"
trace_exporter = "none"
metrics_exporter = "none"
log_user_prompt = false

Launch the app. On the signed-out screen, select Sign in another way, enter your FedRAMP API key, then select Continue. Review credential storage for the storage options your organization can enforce.

Apply network controls

The sample allows Gov API and the FedRAMP model catalog in application.network.domains. Add approved command destinations separately to experimental_network.domains. Allowing model requests to Gov API does not allow agent commands to contact it.

Codex’s network settings do not replace your device firewall.

3. Verify the deployment

  1. Confirm that your policy is active and Codex is using API-key authentication, the selected model, and https://gov.api.openai.com/v1.
  2. Run an approved workflow with sample data. Verify that model requests go to Gov API.
  3. Confirm that user settings cannot override the managed restrictions.

Troubleshoot common problems

Problem What to check
Authentication fails Confirm that the API key belongs to your FedRAMP API organization and has access to the selected model.
Requests use the wrong endpoint Check base_url under [model_providers.fedramp] in requirements.toml.
Restrictions aren’t applied Confirm the intended requirements.toml is loaded on the machine running Codex.
Feature still unavailable Check API-key support, the feature’s settings, and your network controls.

Feature settings

Users cannot override feature settings enforced by requirements.toml.

The table summarizes the configuration above. On means permitted where supported; other permissions and network controls still apply.

Feature Default Notes
Local coding, files, Git, and subagents On —
Local scheduled tasks On —
Browser Off Includes the built-in browser, connected browsers, agent browser control, and Developer mode.
Computer Use and Appshots Off —
Memory and Computer History Off —
Image generation Off Does not block image inputs or reading existing image files.
Web search Off Enable cached search only when supported and approved for your deployment. Command-network rules do not restrict hosted search.
Apps and plugins Off —
Configured MCP servers Off Admins can enable approved servers after accepting the risks for their use case and configuring access and network controls.
Interactive MCP apps Off —
Dictation Off —
Automatic approval review Off —
Remote control Off SSH connections are separate.
App updates Off —

Enabling agent browser use or Computer Use also requires allow_browser_and_computer_use = true.