> ## Documentation Index > Fetch the complete documentation index at: https://docs.builddown.ai/llms.txt > Use this file to discover all available pages before exploring further. # Use Codex with OpenAI > Configure AI-Implement to run the Codex agent against OpenAI, authenticated with an OpenAI API key or your own connected ChatGPT plan. > [!WARNING] > > **Experimental version.** > > This is the latest in-development version of AI-Implement. Features may change without notice and behavior is not guaranteed. Switch to the [latest stable version here](https://docs.builddown.ai/introduction.md). AI-Implement can run the Codex agent against OpenAI. Each OpenAI account profile authenticates one of two ways: an OpenAI API key, or a ChatGPT plan you connect from your own account. Both are configured per account profile on the **Models & providers** page of the admin UI. Set up the profile first, then add a key or connect a plan to it. > [!NOTE] > > Adding an account profile and setting its credentials requires an administrator on the orchestrator's admin UI. ## Account profiles An account profile pairs a set of credentials with the projects allowed to use them. Create one on **Models & providers** with **Add account profile** before you add a key or connect a plan. The form has these fields: * **Profile ID** — a stable, lowercase identifier for the profile. An uppercase letter makes **Set key** fail later, so keep it lowercase. * **Identity** — a label that identifies the account to operators. * **Agent** — `codex`. * **Provider** — `openai`. * **Authentication** — `openai-api-key` for an API key, or `codex-subscription` (shown as **ChatGPT plan**) to connect a ChatGPT plan. * **Permitted projects** — the exact project keys this profile may serve, comma-separated. A profile with no permitted project cannot be selected for any project. A new profile is created **active**. A ChatGPT plan can only be connected while the profile is active. > [!NOTE] > > Readiness is checked against the profile's first permitted project. A profile with no permitted project shows **unknown** readiness. That is a missing probe target, not a rejected credential. ## Use an OpenAI API key **1. Add a codex / openai profile** Create an account profile as described in [Account profiles](#account-profiles), with **Authentication** set to `openai-api-key`. **2. Set the key** In the profile's row, enter the key and click **Set key**. The key is write-only: it is encrypted on save and never shown again. The **API key** column then reads **set**, and an empty profile reads **not set**. **3. Replace or remove the key** To replace the key, enter a new value and click **Set key** again — the new value overwrites the old one. To clear it, click **Remove key**. ## Connect a ChatGPT plan Connecting a ChatGPT plan signs you in with your own ChatGPT account. **It is for personal and self-hosted use of your own plan** — do not use it to pool, share, or resell plan access. For customer-facing OpenAI runs, use an API key instead. Pairing is the normal path: the admin UI mints a code, and a helper on your laptop signs in and uploads the result. You will need: * **A laptop with a web browser.** Sign-in opens a browser and completes through a loopback (`127.0.0.1`) callback, so the browser and the command must run on the same machine. A remote orchestrator cannot receive that callback. * **An AI-Implement source checkout on that laptop, built with `npm run build`**, so the sign-in helper is available. **1. Add a ChatGPT plan profile** Create an account profile as described in [Account profiles](#account-profiles), with **Authentication** set to `codex-subscription` (shown as **ChatGPT plan**). The profile must be **active**. **2. Start pairing** In the profile's row, click **Connect ChatGPT plan**. The admin UI shows a single-use pairing code and the laptop command to run, both shown once. **3. Run the command on your laptop** From your AI-Implement checkout, run the command the admin UI showed: ```bash theme={null} node dist/chatgpt-plan-login.js connect --orchestrator https:// --record ~/.ai-implement/chatgpt-plan.json ``` The command asks for the pairing code at a hidden prompt. Type it there, so it never goes on the command line. It then opens your browser to sign in with ChatGPT and uploads the signed-in record to the orchestrator. Once the upload succeeds, the helper removes the tokens from the laptop so the orchestrator holds the only copy. It does this without revoking them, so there is nothing to sign out on the laptop. Do not revoke the hosted session to "sign out" the laptop after a successful pairing — that would break the orchestrator's copy too. **4. Confirm the connection** Back in the admin UI, click **Check status** to see the connected account and the latest refresh result. > [!WARNING] > > The pairing code works once and expires 15 minutes after it is shown. A rejected upload — a bad record, the wrong profile state, or an oversize record — still spends the code, so if the command fails, click **Connect ChatGPT plan** again to mint a fresh one. If the command uploads the record but you never see a confirmation — a dropped connection after the orchestrator accepted it — the orchestrator may already own the sign-in while the laptop still holds the same tokens. Delete the leftover record file at `~/.ai-implement/chatgpt-plan.json`, and do nothing else to it. Do not sign in, refresh, or reuse it on the laptop, which would make the orchestrator's copy look reused. > [!WARNING] > > Do not run `logout` to clear the leftover record. Local logout revokes the refresh token, and the orchestrator may hold the same one, so it can disconnect the hosted session. Delete the file instead. Then click **Check status** to see whether the orchestrator is connected. If it is connected, you are done. If it is not, click **Connect ChatGPT plan** again and run the command with a fresh code. ### Manual import and host sign-out You can also sign in on the laptop and import the record to the orchestrator by hand, then sign a connected account out from the host. **1. Sign in on the laptop** ```bash theme={null} node dist/chatgpt-plan-login.js login --record ~/.ai-implement/chatgpt-plan.json ``` This opens your browser and saves a signed-in record to the path you give. **2. Import the record to the orchestrator** Pipe in the same record file the previous step wrote: ```bash theme={null} fly ssh console -a -C "node dist/model-account-cli.js chatgpt-import --profile " < ~/.ai-implement/chatgpt-plan.json ``` The record travels over stdin, never on the command line. Delete the laptop record file afterward. Sign a connected account out from the host, which revokes the token at OpenAI and stores a record with no tokens. It works even on a disabled or archived profile, so you can revoke a retired account's session: ```bash theme={null} fly ssh console -a -C "node dist/model-account-cli.js chatgpt-logout --profile " ``` Read the connected account and the refresher's last outcome from the host — it never prints a token: ```bash theme={null} fly ssh console -a -C "node dist/model-account-cli.js chatgpt-status --profile " ``` Inspect the laptop's own record with the local `status` command, which prints the account and time left: ```bash theme={null} node dist/chatgpt-plan-login.js status --record ~/.ai-implement/chatgpt-plan.json ``` The local `logout` command revokes the refresh token and clears the local tokens: ```bash theme={null} node dist/chatgpt-plan-login.js logout --record ~/.ai-implement/chatgpt-plan.json ``` Use local `logout` only on an independent laptop-only sign-in — one you created with `login` and never uploaded or imported. Once the orchestrator holds the same sign-in, revoking it on the laptop disconnects the hosted session too. To sign out a hosted account on purpose, use the host sign-out command above instead. ## How stored credentials are protected The orchestrator stores both API keys and connected ChatGPT plans encrypted, under a key derived from the `RUNNER_TOKEN_SECRET` that every hosted deployment already sets. No extra variable is involved. > [!WARNING] > > Rotating `RUNNER_TOKEN_SECRET` makes every stored credential unreadable, and nothing on the orchestrator can recover the old ones. After a rotation, set each API key again and reconnect or re-import each ChatGPT plan. No token value should ever appear in a command argument, an example, a Git commit, or any published artifact: * The pairing code is typed at a hidden prompt and travels only in a request header, never on the command line. * API keys are write-only in the admin UI and are never shown after you save them. * The sign-in, status, and import commands never print a token. Connect a ChatGPT plan with the sign-in helper above — do not try to reuse a Codex `auth.json` file. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.