Skip to content
aizkaizk

Codex

This page uses the address and public OAuth client of the AIZK deployment serving it. If you have not connected yet, Quickstart lets you choose Codex and ask it to complete the whole setup.

Codex points at the same endpoint every other client uses and signs you in through the same browser flow. The public client ID is not a credential, and PKCE protects the flow without a client secret or shared token.

The plugin setup

Section titled “The plugin setup”

The plugin installs the AIZK skill and MCP connection together. No project file or secret is added.

Terminal window
codex plugin marketplace add phvv-me/aizk && codex plugin add aizk@aizk
codex -c mcp_oauth_callback_port=8912 mcp login aizk

The second command signs in once for the isolated profile. The callback override keeps the loopback port aligned with the public AIZK client registered in Logto.

Ask Codex to call status afterward. Getting your name and organizations back is the real confirmation because a stored credential alone does not prove the server accepted it.

Why the callback port is fixed

Section titled “Why the callback port is fixed”

The callback port pins the loopback redirect registered for the public Logto client. That address belongs to Codex. Codex opens a small listener on that port, the browser hands the authorization result to it and the listener closes.

Codex appends one stable server-specific callback ID. Run the login command once and register the complete redirect_uri printed in its authorization URL with Logto. Registering only http://127.0.0.1:8912/callback is not enough.

Codex on a remote machine

Section titled “Codex on a remote machine”

Open the forward first from the machine with the browser, then log in inside the Codex session.

Terminal window
ssh -N -L 8912:127.0.0.1:8912 remote-host
  your laptop                         remote-host
  ┌────────────────┐                  ┌──────────────────┐
  │ browser        │                  │ codex            │
  │  ▲             │   ssh -L 8912    │  listening on    │
  │  │ redirect to │══════════════════▶  127.0.0.1:8912  │
  │  │ 127.0.0.1   │                  │                  │
  └──┼─────────────┘                  └────────┬─────────┘
     │                                         │
     │        ┌──────────────────┐             │
     └───────▶│ aizk sign-in     │◀────────────┘
              └──────────────────┘   token exchange over https

The forward carries only the final redirect. Everything else travels over ordinary HTTPS from wherever Codex is running. Once login finishes, close the forward and Codex keeps working.

If the port is already taken on either machine, pick another number and change it in the config file and the ssh -L argument. They have to agree.

Agent instructions

Section titled “Agent instructions”

Codex reads AGENTS.md. The rules worth putting there are the same ones Claude Code uses, and they are written out on Claude Code. Merge them into whatever your repository already has.

The key habit is treating found content as evidence rather than instructions. Shared memory can carry text somebody else wrote into the agent’s context. Evidence and provenance explains how each item is labeled.

Next

Section titled “Next”