Codex CLI · September 2026

How to install Codex CLI

Four official routes, three operating systems, one binary — with first run, sign-in by plan, verifying the install, updating, uninstalling, and the errors that stop people at step one.

Pick the route before you type anything.

Every official route installs the same Rust binary, so the choice is about who updates it and where it lands. The standalone installer is OpenAI’s recommended path on macOS, Linux, and Windows and needs nothing but a shell. npm suits machines that already have Node and want one package manager for everything; the package declares Node 16 or newer and carries a prebuilt binary for each platform, so nothing compiles. Homebrew is the tidy option on a Mac. The version this page was checked against is 0.153.0, released 3 September 2026; Codex ships several times a week, so expect a higher number.

Requirements are modest: macOS on Apple Silicon or Intel, Linux on x86_64 or arm64, and on Windows, Windows 11 as the recommended baseline with a recent, fully updated Windows 10 (1809 or newer) as best effort. You also need a ChatGPT plan whose pricing table ticks the CLI — Plus, Pro, Business, Enterprise, or Edu — or an OpenAI API key; the Codex CLI guide covers what each plan gets you.

macOS and Linux.

  1. 01Run the standalone installer

    It detects your OS and architecture, downloads the matching release, places codex in ~/.local/bin (override with CODEX_INSTALL_DIR), and adds that directory to your shell profile if it is not already on PATH. Open a new shell afterwards. If it finds a Homebrew, npm, or bun copy of Codex already installed, it offers to remove it so two versions do not fight over PATH.

    curl -fsSL https://chatgpt.com/codex/install.sh | sh
    The same line updates an existing install.

  2. 02Or install with npm

    The global package puts a codex launcher in npm’s global bin directory and pulls the binary for your platform as an optional dependency. Do not use sudo; if global installs fail with EACCES, fix npm’s prefix instead — see the errors below.

    npm install -g @openai/codex

  3. 03Or install with Homebrew

    Codex is a cask, not a formula, so the --cask flag is not optional.

    brew install --cask codex

  4. 04Verify

    codex --version prints the release. which -a codex should show exactly one path; two means two installs, and the first on PATH wins.

    codex --version which -a codex

Windows.

Codex runs natively on Windows; WSL2 is an option, not a requirement.

  1. 01Run the PowerShell installer

    OpenAI’s standalone installer for Windows, run from an ordinary PowerShell window: it installs under %LOCALAPPDATA%\Programs\OpenAI\Codex\bin, adds that folder to your user PATH, and needs no administrator rights.

    powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

  2. 02Or use npm

    The npm package ships win32-x64 and win32-arm64 binaries, so the global install works natively without WSL.

    npm install -g @openai/codex

  3. 03Set up the native sandbox on first run

    Codex on Windows runs commands inside a native sandbox in one of two strengths. Elevated is the recommended one: it creates dedicated low-privilege sandbox users, filesystem boundaries, and firewall rules, and setting it up needs winget and an administrator’s approval of a UAC prompt — /setup-default-sandbox inside a session starts that. Unelevated is the fallback: commands run under a restricted token derived from your own account, with weaker isolation and no admin needed.

  4. 04Or use WSL2

    Choose WSL2 when you need Linux-native tooling or your repositories already live there. Inside the distribution, run the macOS/Linux installer exactly as above, and keep repositories under a Linux path such as ~/code — /mnt/c/... paths work but are slow. WSL1 has been unsupported since 0.115, when the Linux sandbox moved to bubblewrap.

    curl -fsSL https://chatgpt.com/codex/install.sh | sh
    Inside the WSL2 distribution.

First run and sign-in.

  1. 01Start it inside a repository

    cd into a git checkout and run codex. The default Auto preset — sandboxed writes inside the workspace, approval requested for anything beyond it — applies in version-controlled folders; outside one, expect a prompt about trusting the directory.

    cd ~/code/your-repo codex

  2. 02Sign in with ChatGPT

    Choose “Sign in with ChatGPT”. A browser opens, you approve, and the CLI caches tokens in ~/.codex/auth.json — the auth docs say to treat that file like a password. Plus, Pro, Business, Enterprise, and Edu plans cover the CLI; usage is a five-hour window shared with Codex cloud.

  3. 03Or sign in with an API key

    codex login --with-api-key reads the key from standard input and bills per token at API rates. Features that depend on ChatGPT workspace access or the cloud are unavailable this way.

    printf '%s' "$OPENAI_API_KEY" | codex login --with-api-key

  4. 04On a server with no browser

    Two options from the auth docs: codex login --device-auth prints a code to enter on another device, or forward the sign-in callback port over SSH and complete the browser step on your laptop.

    ssh -L 1455:localhost:1455 user@host codex login

  5. 05Check it

    codex login status reports which credentials are active; /status inside a session shows the model, the sandbox, the working directories, and token use.

Where each route puts things, and how to update or remove it.

RouteBinary lands inUpdateRemove
Standalone, macOS/Linux~/.local/bin/codex, or CODEX_INSTALL_DIRRe-run the installer line, or codex updateDelete the binary and the PATH line it added; there is no uninstaller
Standalone, Windows%LOCALAPPDATA%\Programs\OpenAI\Codex\binRe-run the installer, or codex updateDelete the folder and its user PATH entry
npmnpm’s global bin (npm prefix -g)npm install -g @openai/codex@latestnpm uninstall -g @openai/codex
HomebrewThe codex caskbrew upgrade --cask codexbrew uninstall --cask codex

None of these touch ~/.codex, which holds config.toml, auth.json, and every saved session. Delete it only if you mean to lose your chats, and run codex logout first if the machine is leaving your hands.

The errors people hit.

codex: command not found

The binary is installed but its directory is not on PATH. For the standalone installer, open a new shell — it edited your profile, not your current session. For npm, compare npm prefix -g plus /bin against echo $PATH, and add it.

EACCES on npm install -g

npm’s global directory is owned by root, usually because sudo npm ran once. Do not reach for sudo again; point npm at a directory you own with npm config set prefix ~/.npm-global, add ~/.npm-global/bin to PATH, and reinstall.

Two versions of Codex

codex --version disagrees with what you just installed because an older copy sits earlier on PATH. which -a codex lists them all; remove the one you did not mean to keep. The standalone installer now detects Homebrew, npm, and bun copies and offers to remove them.

The sign-in browser never opens

You are on a remote or headless machine. Use codex login --device-auth, or forward port 1455 over SSH as above and sign in from your laptop’s browser. Copying a working ~/.codex/auth.json from another machine is also documented, with the care you would give a password.

Sandbox errors on Linux

The Linux sandbox uses bubblewrap. Recent releases bundle a fallback helper, but it needs unprivileged user namespaces enabled on the kernel, and hardened distributions and some containers turn them off. codex --sandbox read-only still works while you sort that out, and logs land in ~/.codex/log.

Elevated sandbox setup fails on Windows

A declined UAC prompt, group policy blocking new local users (error 1385 is the classic), or a firewall rule that cannot be written. On a managed device this needs IT; otherwise fall back to the unelevated sandbox rather than full access.

Install it once on a host, then reach it from everywhere.

Notice where all of this happens: on one machine, in one terminal. The install lands, the sign-in lands, the sessions land — on that disk. The moment you want the same Codex from a laptop on the train, a desktop at the office, or a phone, the classical answer is to install and sign in again on each, or to expose the first machine over SSH and carry keys to every device that might need it.

spawnd takes the other route. Install Codex once on the host where the code lives, install the spawnd daemon beside it, and that host dials out to join your fleet — nothing listens on it, no ports open, no VPN. Any browser you approve is the console, including a phone with the app on its home screen; Codex is a built-in shortcut that types codex into a real login shell on the host, so the sign-in and config.toml you just set up apply unchanged, and spawnd holds no provider credentials. Each session is owned by a worker process on the host, so a run keeps going when the laptop closes. The sessions guide covers the persistence half; the Codex CLI guide covers where one machine runs out.

Start

One install on the host, one console everywhere.

$curl -fsSL https://spawnd.dev/install.sh | sh
Sign up free
Install the daemon

Questions

Do I need Node.js to install Codex CLI?
Only for the npm route. The standalone installer and the Homebrew cask download a prebuilt binary and need no Node at all. The npm package declares Node 16 or newer and itself wraps a platform binary.
How do I update Codex CLI?
codex update on any install whose release supports self-update, or the route you installed with: re-run the standalone installer line, npm install -g @openai/codex@latest, or brew upgrade --cask codex. codex --version confirms.
Does installing Codex CLI on Windows require WSL?
No. The PowerShell installer and the npm package both run natively, with a native Windows sandbox. WSL2 is the route OpenAI recommends only when your tooling and repositories already live in Linux; WSL1 is not supported.
How do I uninstall Codex CLI completely?
Remove the binary the way you installed it — delete ~/.local/bin/codex, npm uninstall -g @openai/codex, or brew uninstall --cask codex — then, for a clean slate, codex logout and delete ~/.codex, knowing that removes config and every saved chat.