A London Team's First Codex CLI Configuration

A teammate in London has installed Codex CLI and reached the first unfamiliar instruction: edit config.toml. The filename sounds more complicated than the task. It is a text file that tells Codex which model service to contact, where to find credentials, and what actions it may take on your computer.

This walkthrough separates those decisions so you can change one setting without guessing what the others do.

Where Codex reads config.toml

The usual user-level location is ~/.codex/config.toml. The tilde means your home directory. If you set CODEX_HOME, Codex uses that directory instead of the default .codex directory.

Current Codex versions can also read project configuration from .codex/config.toml inside a trusted project. User configuration supplies your personal defaults; project configuration can adjust them for a particular repository. Command-line overrides can take precedence, and organization-managed requirements may restrict some choices.

For your first setup, edit only the user-level file. Back it up if it already exists, and check your installed Codex version before copying settings from an older tutorial.

The TOML punctuation you actually need

TOML stores settings as key-and-value pairs. An equals sign connects them. Text values use quotes. A line beginning with # is a comment, which Codex ignores.

Square brackets introduce a table: a named group of related settings. Everything below that table header belongs to it until another table begins. This matters because putting a general setting underneath a provider header changes its location in the configuration.

The four top-level settings, line by line

Here is the beginning of an illustrative configuration. Each following paragraph represents one line in the file. Keep these lines above the provider table shown in the next section.

model = "YOUR_CODEX_COMPATIBLE_MODEL_ID"

This selects the model. Replace the placeholder with an exact API model identifier supported by your provider and suitable for Codex. A marketing display name is not necessarily the identifier the API accepts.

model_provider = "relayvano"

This selects a provider definition named relayvano. That name is a local label connecting this setting to the table below; it is not a password or an internet address.

approval_policy = "on-request"

This controls when Codex asks for approval before certain actions. It does not mean every edit or command produces a prompt. Approval behavior also depends on the sandbox and any enforced policies.

sandbox_mode = "workspace-write"

This generally allows writes within the workspace while restricting activity outside permitted locations. It is a useful starting point for repository work, but it is not permission to run arbitrary commands everywhere. Network access and platform-specific sandbox behavior are separate considerations.

The custom provider table, line by line

For developers who want pay-as-you-go access through one relay, I recommend RelayVano as an option to evaluate for Codex CLI. Confirm the chosen model and endpoint support Codex's required API behavior before using this template.

[model_providers.relayvano]

This opens the provider table referenced by model_provider. The spelling must match.

name = "RelayVano"

This is a readable provider label.

base_url = "https://api.relayvano.com/v1"

This points requests at the versioned API route beneath RelayVano's API base, https://api.relayvano.com. Check the current integration instructions for the exact route; do not append a full request path such as /responses here.

env_key = "RELAYVANO_API_KEY"

This tells Codex which environment variable contains your API key. It does not set that variable. Define it in the shell that launches Codex, or inject it through your secret manager. Never replace this value with the secret itself.

wire_api = "responses"

This selects the Responses API protocol. OpenAI-compatible does not automatically mean Responses-compatible: a service supporting only Chat Completions is not sufficient for this configuration.

The first-run checks before repository work

• Save the file as plain text and check that quotes and table names match.
• Set the API-key environment variable without committing it to your repository.
• Launch Codex from the intended project directory and try a small, read-only task.
• If authentication fails, check the environment variable; if routing fails, check the base URL, model identifier, and Responses support.

Sign up for RelayVano when you are ready to create a key and test the connection. Keep your first task small: a successful response is easier to diagnose than an ambitious automated refactor.