The official OpenAI Codex app works with the Codex family through Guard directly: no ChatGPT sign-in, the seven Guard models and the Ultra level. After installation the app is called ChatGPT. You need a gd-… key, a settings file and one line with the key.
- A
gd-…key from the Guard bot: open the bot, get access and copy the key. Usage is charged to the key balance, which you can see in your dashboard. - A computer: a Mac with macOS 13 or later, or a Windows computer with Microsoft Store.
- The app, Codex CLI and the Codex extension for VS Code share one settings file. If you already connected the Codex family in Codex CLI with our guide and the file has the line
model_provider = "guard-codex", step 2 is done: go straight to step 3.
macOS
- Download the installer from the official OpenAI site: Codex.dmg. This build is for Macs with Apple silicon. Other downloads are on the app page.
- Open the downloaded
Codex.dmgand drag the ChatGPT icon into the Applications folder. - Do not start the app yet. If it is already open, quit it: menu ChatGPT → Quit ChatGPT or
Cmd+Q. You do not need to sign in to ChatGPT.
Windows: install the app from Microsoft Store with the official link: install ChatGPT. Alternatively, run this command in PowerShell:
winget install --id 9PLM9XGG6VKS -s msstoreDo not start the app yet. If it is already open, close it. You do not need to sign in to ChatGPT.
The app reads its settings from config.toml, the same file Codex CLI uses. If the file already has content, back it up and change only the lines below.
macOS: open the Terminal app: press Cmd+Space, type Terminal and press Return. Paste the commands and press Return. The folder and an empty file are created if they do not exist yet, and the file opens in TextEdit.
mkdir -p ~/.codex
touch ~/.codex/config.toml
open -e ~/.codex/config.tomlWindows: open PowerShell from the Start menu. Paste the commands and press Enter. The file opens in Notepad.
$codexConfig = Join-Path $env:USERPROFILE ".codex\config.toml"
New-Item -ItemType Directory -Force (Split-Path $codexConfig) | Out-Null
if (-not (Test-Path $codexConfig)) { New-Item -ItemType File $codexConfig | Out-Null }
notepad $codexConfigThe settings come in two blocks. Put the cursor at the very beginning of the file: Cmd+↑ in TextEdit, Ctrl+Home in Notepad. Copy the first block with the copy button, paste it and press Return (Enter on Windows) right away so the block does not merge with the next line. If some of these lines already exist in the file, edit them instead of adding second copies.
model = "gpt-6-astra"
model_provider = "guard-codex"
model_reasoning_effort = "medium"
model_context_window = 872000Then go to the very end of the file: Cmd+↓ in TextEdit, Ctrl+End in Notepad. Press Return (Enter) to start a new line, paste the second block and save the file: Cmd+S in TextEdit, Ctrl+S in Notepad. The [model_providers.guard-codex] section must appear only once: if it already exists, edit its lines instead of adding a second one.
[model_providers.guard-codex]
name = "GUARD API · Codex"
base_url = "https://api.guardrelay.ai/codex/v1"
env_key = "GUARD_API_KEY"
wire_api = "responses"| Line | What it means |
|---|---|
model | The default model. You can switch models in the app's model menu. |
model_provider | Every task in the app goes through Guard. |
model_reasoning_effort | The default reasoning level, here Medium. |
model_context_window | The chat history budget: 872000 for the 6 and 5.6 models, 272000 for 5.5. |
name | The app shows this label at the bottom left instead of an account. |
base_url | The Guard address for the Codex family. Do not add anything to it. |
env_key | The name of the variable that holds the key, not the key itself. Save the key in step 3. |
wire_api | The Responses protocol, do not change it. |
An app opened from the Dock or the Start menu does not see a key that was set in a single terminal window only. That is why the key must be saved permanently.
macOS: copy the command below with the copy button, paste it into Terminal and press Return. It is one long line, do not split it. At the Guard API key: prompt paste your key and press Return again. The key is not shown on screen and does not go into the command history. If the prompt appears again, paste the key once more. The command appends it as an export GUARD_API_KEY=… line to the end of ~/.zshrc, which the app reads at startup.
unset GUARD_API_KEY; until [ -n "$GUARD_API_KEY" ]; do printf "Guard API key: "; read -r -s GUARD_API_KEY; printf "\n"; done; printf '\nexport GUARD_API_KEY="%s"\n' "$GUARD_API_KEY" >> ~/.zshrc; unset GUARD_API_KEY; grep -c '^export GUARD_API_KEY="gd-' ~/.zshrcAt the end the command must print 1. If it prints 0, the key was not saved: make sure you copy the whole gd-… key and run the command again. If it prints 2 or more, the key was written several times: open the file with open -e ~/.zshrc, keep one export GUARD_API_KEY=… line with the current key and save the file.
If echo $SHELL prints /bin/bash rather than /bin/zsh, replace both ~/.zshrc in the command with ~/.bash_profile. If you have no ~/.bash_profile but do have ~/.profile, use ~/.profile.
Windows: paste the commands into PowerShell and press Enter. At the Guard API key prompt paste the key and press Enter. The key is saved as the user variable GUARD_API_KEY, and every program started afterwards sees it.
$guardKey = Read-Host "Guard API key" -AsSecureString
[Environment]::SetEnvironmentVariable("GUARD_API_KEY", [System.Net.NetworkCredential]::new("", $guardKey).Password, "User")
[Environment]::GetEnvironmentVariable("GUARD_API_KEY", "User").StartsWith("gd-")The last command must print True. To replace the key, run the commands again with the new key.
If the app runs its agent in WSL (see the app settings), repeat steps 2 and 3 inside WSL: the settings file ~/.codex/config.toml and the key line in ~/.profile.
- If the app is open, quit it completely. On macOS: menu ChatGPT → Quit ChatGPT or
Cmd+Q. On Windows: close the window and make sure the app icon is not in the notification area. The app reads the key and settings only at startup. - Open ChatGPT again: on macOS from the Applications folder, on Windows from the Start menu.
- You do not need to sign in to ChatGPT. The label GUARD API · Codex appears at the bottom left instead of an account: the app has read the Guard settings.
- At the bottom right of the input field click the button with the model name, for example 6 Astra Medium. A panel opens: the slider changes the reasoning level, and the row with the arrow opens the Select model list.
- The list shows seven models: 6 Astra, 6 Sol, 6 Luna, 5.6 Sol, 5.6 Terra, 5.6 Luna and 5.5. The list alone does not prove that the key and the address are right: the first task in step 5 checks the connection.
- Press
Cmd+Oon macOS orCtrl+Oon Windows. The same command is in the menu File → Open Folder…. - Choose the project folder and confirm. On macOS you can press
Cmd+Shift+Gin the picker and paste the folder path. The folder appears on the left under Projects. - In the input field at the bottom of the window write a task, for example: Read the list of files in this folder and explain what is where. Send it with
ReturnorEnter. If a reply arrives, the connection to Guard works. - Continue in the same chat, for example: Now tell me more about one of these files.
The access mode is chosen at the bottom left of the input field. The default is Ask for approval: the app works inside the project folder on its own and asks before it changes files outside the folder or goes to the internet. Click Allow once only for actions you understand.
The cost of every request is shown in your dashboard. Besides your tasks, the app sends short service requests, for example it names the chat with the 5.6 Luna model. They are shown in the dashboard too and cost a fraction of a cent.
You can change the model and the level between messages in the menu from step 4, no new key is needed. Model prices are in Models.
| Model in the app | ID for the settings file | Reasoning levels |
|---|---|---|
| 6 Astra | gpt-6-astra | Light, Medium, High, Extra High, Max, Ultra |
| 6 Sol | gpt-6-sol | Light, Medium, High, Extra High, Max, Ultra |
| 6 Luna | gpt-6-luna | Light, Medium, High, Extra High, Max |
| 5.6 Sol | gpt-5.6-sol | Light, Medium, High, Extra High, Max, Ultra |
| 5.6 Terra | gpt-5.6-terra | Light, Medium, High, Extra High, Max, Ultra |
| 5.6 Luna | gpt-5.6-luna | Light, Medium, High, Extra High, Max |
| 5.5 | gpt-5.5 | Light, Medium, High, Extra High |
If the app is in Russian, the levels are called Лёгкий, Среднее, Высокое, Очень высокое, Макс. and Ультра.
If you make 5.5 the default model in the settings file, change the window with it: model_context_window = 272000.
Ultra is available for 6 Astra, 6 Sol, 5.6 Sol and 5.6 Terra. At this level the model reasons with Extra High or Max effort, depending on the model, and the app may split the task between several agents on its own. Each agent uses tokens separately, so Ultra spends the balance noticeably faster, and the app warns about this as well. Medium or High is enough for everyday tasks.
While the settings file contains model_provider = "guard-codex", every task in the app goes through Guard and is paid from the key balance. The same applies to Codex CLI and the Codex extension for VS Code, since they share the settings file.
To go back to your ChatGPT subscription, open the settings file as in step 2, put # at the start of this line, save the file and restart the app:
# model_provider = "guard-codex"To work through Guard again, remove the # and restart the app. Chats started through Guard keep working through Guard, so start a new chat after switching.
| What you see | What to do |
|---|---|
| The app asks you to sign in to ChatGPT, there is no GUARD API · Codex label at the bottom left | The app did not read the settings file. Check the path: ~/.codex/config.toml on macOS, %USERPROFILE%\.codex\config.toml on Windows. The model_provider = "guard-codex" line must come before the first [section] line and must not start with #. After fixing it, restart the app completely. |
Missing environment variable: GUARD_API_KEY | The app started without the key. Repeat step 3 and restart the app completely. A restart is enough, you do not need to sign out of Windows. |
401 or invalid_api_key | An incomplete or old key is saved. Repeat step 3 with your current gd-… key. On macOS remove the old line from ~/.zshrc. |
| A task gets no reply or the app reports a connection error | Check that base_url in the settings file is exactly https://api.guardrelay.ai/codex/v1 with nothing extra, and restart the app completely. |
model_not_found | The name in the model line must match an ID from the model table exactly. |
402 or a balance message | The key does not have enough funds. Top up in the bot; the remaining balance is in your dashboard. |
A settings file error, for example duplicate key or expected newline | The file has a duplicate or two lines merged into one. Open the file as in step 2: every setting must be on its own line and appear only once, and so must the [model_providers.guard-codex] section. |
If the error persists, write to Guard support with your system, app version, model, error text and time. Do not send the key or the settings file.