Skip to main content
Codex talks the OpenAI API, so the resource you point it at needs an OpenAI-compatible provider attached — OpenAI, OpenRouter, Vercel AI Gateway, Microsoft Foundry, or a custom OpenAI-compatible endpoint. See AI Gateway Overview if you haven’t set that up yet. You’ll need the resource’s URL (its <endpoint>) and its API key (<key>). Both are on the resource’s Keys page.
Public vs. private resourcesWherever these instructions show <key>, what you put there depends on the resource type:
  • Public resource - reachable from anywhere, so the gateway checks a virtual API key. Copy it from the resource URL after login, the Resource Launcher more-info panel, or https://app.pangolin.net/<org-id>/keys (use your self-hosted dashboard URL in place of app.pangolin.net if you self-host).
  • Private resource - only reachable from devices connected to your Pangolin network, so no key is checked. You must have the Pangolin client installed and connected. Use the literal string none as the key.
Don’t delete the key field for private resources. Most clients refuse to start without some key set, so they need an inert placeholder rather than a missing one.

​
Fastest: Pangolin CLI

Install the Pangolin CLI if you don’t have it, then log in:
Configure Codex against a resource:
This prompts you to pick an organization and resource if you have more than one, fetches a key for you if the resource needs one, and merges a pangolin provider into ~/.codex/config.toml without touching anything else in that file. To skip the prompts:
To undo it:

​
Manual setup

Merge this into ~/.codex/config.toml (honors $CODEX_HOME if you’ve set it):
Codex reads the key from the environment variable named in env_key, not from the file. Before running Codex, export it in your shell:
Codex is the one client here that also tolerates no key at all: for a private resource you can drop the env_key line and skip the export entirely. Exporting PANGOLIN_API_KEY=none works too, so use whichever you find clearer.