Recommended: use env_key — Codex reads the environment variable at startup and sends it as a Bearer Token. Alternatively, use experimental_bearer_token to embed the key directly. Use one or the other, not both.
Recommended: config.toml with env_key
TOML
model = "gpt-5.5"
model_provider = "neotoken"
[model_providers.neotoken]
name = "Neotoken"
base_url = "https://your-router-domain.com/v1"
env_key = "NEOTOKEN_API_KEY"
wire_api = "responses"
supports_websockets = falseAlternative: config.toml with Bearer Token
TOML
model = "gpt-5.5"
model_provider = "neotoken"
[model_providers.neotoken]
name = "Neotoken"
base_url = "https://your-router-domain.com/v1"
experimental_bearer_token = "YOUR_API_KEY"
wire_api = "responses"
supports_websockets = falseConfig file location
macOS
Config file is usually at ~/.codex/config.toml .
Open in terminal:
mkdir -p ~/.codex && open -e ~/.codex/config.tomlSet for current shell session:
export NEOTOKEN_API_KEY=YOUR_API_KEYFor a permanent setting, add it to ~/.zshrc, then reopen the terminal or run source ~/.zshrc.
Windows
Config file is usually at %USERPROFILE%\.codex\config.toml .
Open with PowerShell:
mkdir $env:USERPROFILE\.codex -Force; notepad $env:USERPROFILE\.codex\config.tomlSet for current PowerShell session:
$env:NEOTOKEN_API_KEY = "YOUR_API_KEY"For a permanent setting: [Environment]::SetEnvironmentVariable("NEOTOKEN_API_KEY", "YOUR_API_KEY", "User") — reopen the terminal for the change to take effect.
Which should I use?
- env_key is more secure — the key is never written to config.toml. Recommended for everyday use.
- experimental_bearer_token is simpler to configure but writes the key to config.toml. Only recommended for local debugging or controlled environments.
- After changing the environment variable or config.toml, restart Codex for the new settings to take effect.
