How to use
Codex.

1. 01

   Start at https://openai.com/codex/ and confirm the domain before entering account or payment information.

2. 02

   Availability: Codex is available through the ChatGPT desktop app, a command-line interface, IDE extensions, and cloud tasks, with different isolation and collaboration options across surfaces.

3. 03

   An eligible OpenAI account, an approved local or cloud environment, a version-controlled repository, and explicit decisions about sandbox, network, approval, secrets, and review policy.

4. 04

   Sign in with the account you intend to keep using, then review plan, data, notification, and permission settings.

5. 05

   Run one low-risk test task before connecting sensitive files, repositories, or workspace data.

• Use official download pages.
• Review permissions during setup.
• Keep installers and applications updated.

1. 01

   Open a clean repository branch and read the project instructions, current status, and trusted validation commands.

2. 02

   State the goal, relevant context, constraints, non-goals, and an observable definition of done.

3. 03

   Use Plan mode for a complex task, then keep filesystem, network, and command authority at the minimum needed.

4. 04

   Inspect the complete diff and run trusted checks independently before committing or releasing through the normal review path.

• State the outcome before the background.
• Provide the real source material.
• Review the result before expanding the task.

1. 01

   Restate the intended behaviour and the acceptance criteria before reading a single generated line.

2. 02

   Read the diff rather than the chat summary; the summary describes intent, the diff describes what actually changed.

3. 03

   Run the test suite, then write a test that would fail if the change were wrong, and confirm it passes for the right reason.

4. 04

   Check the edges the model tends to skip: error paths, null and empty cases, concurrency, and migration or rollback behaviour.

5. 05

   Trace every new dependency, network call, and file write, and confirm each one is genuinely required.

• Review the diff, never the description of the diff.
• A passing test suite proves the tests pass, not that the change is correct.
• Keep changes small enough that a human can actually review them.

1. 01

   Decide what the tool may read and what it may write before connecting a repository.

2. 02

   Scope tokens and integrations to the narrowest repository, branch, and permission set that still works.

3. 03

   Keep secrets out of the context window: use environment variables and secret stores, never inline credentials.

4. 04

   Require review before generated code touches authentication, payments, permissions, migrations, or deletion paths.

5. 05

   Audit what the integration retained after the session, and revoke access that is no longer needed.

• Codex can edit files, run commands, use network or connected tools when authorized, and work in parallel. Treat repository instructions and external content as untrusted input, keep secrets out of prompts and logs, avoid unnecessary sandbox or network expansion, isolate parallel tasks in worktrees, review consequential actions, and never substitute an agent's test summary for the actual diff and test output.
• Follow your organisation's approved-use policy.
• Never treat fluent output as authorization to act.

• OpenAI Codex overview ↗
• Codex best practices ↗
• Codex agent approvals and security ↗
• Codex AGENTS.md guidance ↗

Working on something like this? See how we handle product engineering, or book a call.