Codex API Admin Guide

cd /var/www/api3
docker-compose up -d

docker-compose logs -f codex-api

docker-compose down

# Check if NPM wrapper exists
ls -la /root/.nvm/versions/node/v24.10.0/bin/codex

# Check if real binary exists
ls -la /root/.nvm/versions/node/v24.10.0/lib/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex

# Verify version using NPM wrapper
export PATH="/root/.nvm/versions/node/v24.10.0/bin:$PATH"
/root/.nvm/versions/node/v24.10.0/bin/codex --version

# Expected output:
# codex version 0.63.0

# Check Node.js version
node --version
# Expected: v24.10.0

# Check current user
whoami

# Check if service is running as root
ps aux | grep uvicorn | grep -v grep

# Set up environment variables
export CODEX_HOME=/opt/codex
export PATH="/root/.nvm/versions/node/v24.10.0/bin:$PATH"

# Method 1: Direct login with API key (using real binary)
/root/.nvm/versions/node/v24.10.0/lib/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex login --with-api-key

# Then paste your API key when prompted, OR pipe it:
echo "sk-your-api-key-here" | /root/.nvm/versions/node/v24.10.0/lib/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex login --with-api-key

# Method 2: Using NPM wrapper (recommended)
/root/.nvm/versions/node/v24.10.0/bin/codex login --api-key "sk-...your-api-key-here"

# Method 3: Environment variable (recommended for containers)
export OPENAI_API_KEY="sk-...your-api-key-here"
/root/.nvm/versions/node/v24.10.0/bin/codex login

# Method 4: Permanent configuration
mkdir -p /opt/codex
cat > /opt/codex/config.toml << EOF
[auth]
api_key = "sk-...your-api-key-here"
EOF

# Set environment variables
export CODEX_HOME=/opt/codex
export PATH="/root/.nvm/versions/node/v24.10.0/bin:$PATH"

# Check current authentication status (using real binary)
/root/.nvm/versions/node/v24.10.0/lib/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex login status

# Or using NPM wrapper
/root/.nvm/versions/node/v24.10.0/bin/codex whoami

# Expected output for OAuth:
# You are logged in as: user@example.com
# Authentication method: OAuth
# Token expires: 2024-12-31

# Expected output for API key:
# You are logged in with API key
# Key ID: sk-...xxxx
# Authentication method: API Key

# If not authenticated, you'll see:
# Error: Not authenticated. Please run 'codex login' first.

# List available models (tests actual API access)
/root/.nvm/versions/node/v24.10.0/bin/codex models list

# Expected output:
# Available models:
# - gpt-5.1-codex-max
# - gpt-5.1-codex
# - gpt-5.1-codex-mini
# - gpt-5.1
# - gpt-5
# - codex-cli
# - gpt-5.1-codex low
# - gpt-5.1-codex medium
# - gpt-5.1-codex high
# - gpt-5.1-codex extra high
# (All 10 models are available)

# Check current permissions
ls -la /opt/codex/

# Set proper ownership (already root:root)
sudo chown -R root:root /opt/codex/

# Set secure permissions
sudo chmod 700 /opt/codex/
sudo chmod 600 /opt/codex/auth.json
sudo chmod 600 /opt/codex/config.toml

# Verify
sudo -u root ls -la /opt/codex/

# API Wrapper Configuration
# This is the key your API clients will use
PROXY_API_KEY=eric

# Codex CLI Configuration - EXACT PATHS FOR THIS SERVER
CODEX_HOME=/opt/codex
CODEX_WORKDIR=/workspace/codex-api3

# EXACT PATHS - DO NOT CHANGE
CODEX_PATH=/root/.nvm/versions/node/v24.10.0/lib/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex
CODEX_BINARY_PATH=/root/.nvm/versions/node/v24.10.0/lib/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex

# Path to Codex CLI NPM wrapper
PATH=/root/.nvm/versions/node/v24.10.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
NODE_PATH=/root/.nvm/versions/node/v24.10.0/lib/node_modules

# API Configuration
PORT=5203
HOST=0.0.0.0

# Rate Limiting
RATE_LIMIT_PER_MINUTE=120

# Optional: Default model
DEFAULT_MODEL=gpt-5.1-codex

# Optional: Maximum parallel requests
CODEX_MAX_PARALLEL_REQUESTS=4

# Optional: Request timeout in seconds
CODEX_TIMEOUT=120

# Security Settings
CODEX_SANDBOX_MODE=workspace-write
CODEX_ALLOW_DANGER_FULL_ACCESS=0

# 1. Start the API service
cd /var/www/api3
sudo systemctl start codex-wrapper-api3

# 2. Check service status
sudo systemctl status codex-wrapper-api3

# 3. Test health endpoint
curl http://localhost:5203/health

# 4. Test with invalid proxy key (should fail)
curl -X POST http://localhost:5203/v1/chat/completions \
  -H "Authorization: Bearer invalid-key" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-5.1-codex", "messages": [{"role": "user", "content": "test"}]}'

# Expected: {"detail": "Invalid proxy API key"}

# 5. Test with valid proxy key
curl -X POST http://localhost:5203/v1/chat/completions \
  -H "Authorization: Bearer eric" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-5.1-codex", "messages": [{"role": "user", "content": "Hello"}]}'

# Expected: Successful response with message content

# Systemd service restart
sudo systemctl restart codex-wrapper-api3
sudo systemctl status codex-wrapper-api3

# Check logs
sudo journalctl -u codex-wrapper-api3 -f

# Manual restart (if needed)
sudo pkill -f "uvicorn app.main:app"
cd /var/www/api3
nohup python -m uvicorn app.main:app --host 0.0.0.0 --port 5203 > /var/log/codex-api3.log 2>&1 &

# Verify it's running
ps aux | grep uvicorn
netstat -tulpn | grep 5203

# Set file permissions
sudo chmod 600 /opt/codex/auth.json
sudo chmod 600 /opt/codex/config.toml
sudo chmod 600 /var/www/api3/.env

# Add to .gitignore
echo -e ".env\n/opt/codex/\n*.key\n*.pem" >> /var/www/api3/.gitignore

# Use system keyring (alternative)
# Store sensitive data in system keychain/keyring
# Reference via environment variables at runtime

# Rotate proxy key
# 1. Generate new key
NEW_KEY=$(openssl rand -hex 32)

# 2. Update .env file
sudo sed -i "s/PROXY_API_KEY=.*/PROXY_API_KEY=$NEW_KEY/" /var/www/api3/.env

# 3. Restart service
sudo systemctl restart codex-wrapper-api3

# 4. Update all client applications with new key

# Rotate OpenAI API key
# 1. Generate new key in OpenAI dashboard
# 2. Re-login with new key
sudo su - root
cd /var/www/api3
export PATH="/root/.nvm/versions/node/v24.10.0/bin:$PATH"
/root/.nvm/versions/node/v24.10.0/bin/codex login --api-key "sk-new-key-here"

# 3. Verify
/root/.nvm/versions/node/v24.10.0/bin/codex whoami
/root/.nvm/versions/node/v24.10.0/bin/codex models list

# Create backup script
cat > /var/www/api3/backup-codex-auth.sh << 'EOF'
#!/bin/bash
BACKUP_DIR="/backup/codex-auth/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR

# Backup Codex auth
cp -r /opt/codex $BACKUP_DIR/

# Backup environment
cp /var/www/api3/.env $BACKUP_DIR/.env.backup

# Encrypt backup
gpg --symmetric --cipher-algo AES256 --output $BACKUP_DIR.tar.gz.gpg $BACKUP_DIR/

# Cleanup unencrypted backup
rm -rf $BACKUP_DIR

echo "Backup created: $BACKUP_DIR.tar.gz.gpg"
EOF

chmod +x /var/www/api3/backup-codex-auth.sh

# Recover from backup
gpg --decrypt backup.tar.gz.gpg | tar -xz
sudo cp -r extracted/.codex /opt/
sudo cp extracted/.env.backup /var/www/api3/.env

# Set proper permissions
sudo chmod 700 /opt/codex
sudo chmod 600 /opt/codex/*
sudo chmod 600 /var/www/api3/.env

# 1. Check system information
echo "Current user: $(whoami)"
echo "Home directory: $HOME"
echo "PATH: $PATH"
echo "Codex location: $(/root/.nvm/versions/node/v24.10.0/bin/codex --version)"

# 2. Check Codex installation
/root/.nvm/versions/node/v24.10.0/bin/codex --version
/root/.nvm/versions/node/v24.10.0/bin/codex --help

# 3. Check authentication
/root/.nvm/versions/node/v24.10.0/bin/codex whoami
echo "Codex home: ${CODEX_HOME:-/opt/codex}"
ls -la ${CODEX_HOME:-/opt/codex}/

# 4. Check network connectivity
curl -I https://api.openai.com/v1/models
telnet api.openai.com 443

# 5. Check service status
sudo systemctl status codex-wrapper-api3
ps aux | grep uvicorn
netstat -tulpn | grep 5203

# 6. Check environment
sudo cat /var/www/api3/.env | grep -v "PROXY_API_KEY"

# 7. Test minimal request
curl -v http://localhost:5203/health

# 8. Test with debug logging
cd /var/www/api3
export LOG_LEVEL=DEBUG
python -m uvicorn app.main:app --host 0.0.0.0 --port 5203 --log-level debug

# Check if ports are blocked
# For OAuth port
nc -zv localhost 1455

# For API port
nc -zv localhost 5203

# For API access
nc -zv api.openai.com 443

# If using corporate proxy
export https_proxy=http://proxy.company.com:8080
export http_proxy=http://proxy.company.com:8080

# Check DNS
nslookup api.openai.com
dig api.openai.com

# Test connectivity
ping -c 3 api.openai.com
curl -I https://api.openai.com

# Requests per minute per client (configured for this server)
RATE_LIMIT_PER_MINUTE=120

# Burst capacity (optional)
RATE_LIMIT_BURST=10

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 119
X-RateLimit-Reset: 1638360000

# UFW example
sudo ufw allow from 10.0.0.0/8 to any port 5203
sudo ufw deny 5203

# iptables example
sudo iptables -A INPUT -p tcp --dport 5203 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5203 -j DROP

# Check current version (NPM wrapper)
/root/.nvm/versions/node/v24.10.0/bin/codex --version

# Current expected version: 0.63.0

# Update to latest
npm update -g @openai/codex

# Verify update didn't change binary path
ls -la /root/.nvm/versions/node/v24.10.0/lib/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex

# If binary path changed after update, update .env file
# Edit /var/www/api3/.env and update CODEX_PATH and CODEX_BINARY_PATH

cd /var/www/api3
# Update all packages
pip install -r requirements.txt --upgrade

# Check for outdated packages
pip list --outdated

curl -X POST "http://localhost:5203/v1/chat/completions" \
  -H "Authorization: Bearer eric" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.1-codex",
    "messages": [
      {"role": "system", "content": "You are a helpful assistant."},
      {"role": "user", "content": "Explain quantum computing"}
    ],
    "max_tokens": 500
  }'

curl -X POST "http://localhost:5203/v1/chat/completions" \
  -H "Authorization: Bearer eric" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.1-codex",
    "messages": [{"role": "user", "content": "Write a poem"}],
    "stream": true
  }'

import asyncio
import aiohttp

async def batch_process(prompts, max_concurrent=5):
    semaphore = asyncio.Semaphore(max_concurrent)

    async def process(prompt):
        async with semaphore:
            async with aiohttp.ClientSession() as session:
                async with session.post(
                    "http://localhost:5203/v1/chat/completions",
                    headers={"Authorization": "Bearer eric"},
                    json={
                        "model": "gpt-5.1-codex",
                        "messages": [{"role": "user", "content": prompt}]
                    }
                ) as resp:
                    return await resp.json()

    tasks = [process(prompt) for prompt in prompts]
    return await asyncio.gather(*tasks)

# Usage
prompts = ["Task 1", "Task 2", "Task 3", "Task 4", "Task 5"]
results = asyncio.run(batch_process(prompts))