What Codex Host can access, and what it does not store.

Account authentication

The website uses GitHub OAuth to identify your Codex Host account. OpenAI/Codex and development GitHub access are connected separately from inside your hosted machine using their device authorization flows. Codex Host does not ask for your OpenAI or GitHub password.

Where development credentials live

OpenAI/Codex credentials and the GitHub credentials used for your repositories are intended to remain inside your isolated hosted environment. They are not copied into the Codex Host D1 control-plane database.

The website account itself still has normal GitHub OAuth/session metadata for sign-in. That is separate from the credentials used to clone and work with repositories inside the host.

Isolation and networking

Each customer gets a separate provider environment with fixed CPU, memory, disk, and machine-count limits. Codex internal control ports are not intentionally exposed as public inbound services. The host primarily makes outbound connections to services such as OpenAI, GitHub, and the infrastructure provider.

The isolation boundary ultimately depends on the underlying compute provider. Codex Host does not claim that provider isolation is a formally verified security boundary.

Operator and provider access

Codex Host is not end-to-end encrypted against its operator or infrastructure provider. The control plane can issue specific lifecycle and host-management commands through the provider management plane, and the provider may have infrastructure-level access to the machine. Do not use Codex Host for data that requires a zero-access or zero-knowledge hosting model.

What the control plane stores

The service stores the information needed to run the account and machine lifecycle: account identity, session metadata, Stripe customer/subscription identifiers and status, provider machine identifiers, resource shape, machine state, lifecycle events, support submissions, capacity records, and limited product analytics.

Product analytics do not intentionally contain source code, repository contents, prompts, ChatGPT conversations, device authorization codes, Remote pairing codes, OAuth tokens, or payment-card details.

Billing and webhooks

Payments are handled by Stripe. Codex Host provisions paid compute only from verified server-side Stripe state; the browser success page is not treated as proof of payment. Stripe webhook signatures are verified and lifecycle events are processed idempotently.

Deletion

When an entitlement ends, Codex Host requests deletion of the underlying provider environment and releases its capacity slot. Machine cleanup is reconciled so an interrupted deletion can be retried. Control-plane account, billing, lifecycle, and audit records are separate from the provider machine and may remain after the machine is deleted.

Report a security issue

Signed-in users can use the support form. Do not include passwords, tokens, private keys, device codes, or other live credentials in a support message.