Yes. You can use local Codex surfaces with an OpenAI API key instead of a ChatGPT subscription. OpenAI's current authentication documentation says the ChatGPT desktop app, Codex CLI, and Codex IDE extension support API-key sign-in for local work.
There are two important limits. First, API usage is billed separately through the OpenAI Platform account that owns the key; this is not free Codex and it does not draw from a ChatGPT plan. Second, Codex Cloud requires ChatGPT sign-in. Some features that depend on ChatGPT workspace access or cloud services are also limited or unavailable with API-key authentication.
The right question is therefore not only “Can I use Codex without Plus?” It is “Do I need local Codex or Codex Cloud, which account should own the bill, and which workspace features matter?”
Last verified: 2026-08-27. Authentication methods, feature availability, model access, rates, and plan rules can change. Recheck OpenAI's official documentation and your live account before relying on a path.
ChatGPT sign-in vs API key for Codex
OpenAI documents two sign-in methods for people using OpenAI models in Codex:
This table compares authentication paths, not total cost. A subscription has a recurring price and product allowance. An API key has usage-based charges that depend on the model and the work. Neither path is always cheaper.
For the full billing breakdown, including plan allowance, Credits, API usage, and organization rate cards, use the dedicated Codex pricing guide.
Which Codex surfaces work without a ChatGPT subscription?
The official Codex authentication page says three local surfaces support API-key authentication:
- the ChatGPT desktop app when doing local Codex work;
- Codex CLI;
- the Codex IDE extension.
In each case, the user still needs a valid OpenAI Platform API key and an API account that can pay for the selected model's usage. “Without a ChatGPT subscription” does not mean without an OpenAI account, credential, supported model, or bill.
The local qualifier matters. Your files and commands run through the local Codex environment and its current permissions. Features that depend on ChatGPT workspace membership, ChatGPT-managed entitlement, or OpenAI's cloud execution service may not follow you to an API-key session.
This is also why a model and a working product surface should be checked separately. A model appearing in the API catalog does not prove it is available in every Codex interface. The agent harness vs model guide explains the distinction.
Why Codex Cloud still requires ChatGPT sign-in
Codex Cloud is more than a model endpoint. It creates and runs tasks in isolated cloud environments, connects to repositories and integrations, and applies ChatGPT workspace access and controls.
OpenAI's authentication documentation states that Codex Cloud requires signing in with ChatGPT. An API key can pay for model calls in supported local Codex workflows, but it does not become a ChatGPT workspace identity or grant the cloud product's permissions.
Use ChatGPT sign-in when the workflow specifically depends on Codex Cloud, ChatGPT workspace governance, or a cloud integration that the current feature-availability page ties to that identity. Use an API key when the work is local or programmatic and should be billed to an API project.
Do not treat those as interchangeable credentials. They answer different security and product questions.
Authentication is only one part of the choice. If the open question is how the work itself should run, compare Codex Cloud and Codex CLI by execution location, interaction, parallelism, permissions, and review boundaries.
How to sign in to Codex CLI with an API key
OpenAI's documented CLI flow sends the key to codex login through standard input:
A safe setup sequence is:
- Create or select the correct OpenAI Platform project.
- Configure billing limits and usage monitoring for that project.
- Create a key with the minimum practical ownership and access scope.
- Put the key in the
OPENAI_API_KEYenvironment variable in a trusted environment. - Pipe it to
codex login --with-api-keyrather than pasting it into source code, a prompt, or a shared terminal transcript. - Run
codex login statusto confirm the active authentication method. - Remove or rotate the credential when the environment or owner changes.
Do not commit an API key to Git, add it to a public CI log, or expose a Codex automation endpoint to untrusted users. OpenAI specifically recommends API-key authentication for trusted programmatic workflows such as private CI/CD jobs—not for giving the public an unrestricted path to agent execution.
The ChatGPT desktop app and IDE extension provide their own API-key sign-in controls. Use the current interface rather than copying a CLI credential file between devices.
What this page does not decide about price
API-key authentication answers whether supported local Codex can run without a ChatGPT subscription. It does not prove that the API path is cheaper. API usage belongs to the Platform project that owns the key, while ChatGPT plan usage and eligible Credits remain separate product ledgers.
Use the Codex pricing guide linked above for the current billing comparison. When deciding between the two paths, price the same accepted task—including retries, tools, and review—rather than comparing a subscription headline with a token rate in isolation.
What may be limited with API-key authentication?
OpenAI's documentation warns that some features relying on ChatGPT workspace access or cloud services are limited or unavailable when you sign in with an API key.
The exact list can change, so use the official feature-availability page rather than memorizing a static table. The durable boundary is:
- local model-backed Codex work can use an API key;
- Codex Cloud and ChatGPT workspace identity require ChatGPT sign-in;
- OAuth-dependent integrations or plugins may not work through an API-key-only path;
- API organization data and administration policies apply instead of ChatGPT workspace policies.
If a feature matters to the purchase decision, verify it while signed in using the intended method. Do not assume that seeing the feature under one account means the other authentication method includes it.
Which path should you choose?
Choose API-key authentication when
- you need local Codex CLI, IDE, or desktop work;
- usage should belong to a specific API project or engineering budget;
- automation runs in a trusted private environment;
- you want to choose among the current GPT-5.6 Codex model profiles supported by both the API and that local Codex surface;
- you can manage credentials, budgets, and monitoring safely.
Choose ChatGPT sign-in when
- you need Codex Cloud;
- the work must follow ChatGPT workspace membership, roles, retention, or residency controls;
- you rely on a feature or integration tied to ChatGPT workspace access;
- you prefer the current plan-and-Credits product path over a separate API bill.
Evaluate both when
- interactive work and automation should have different bill owners;
- a team needs ChatGPT governance for people but API projects for private CI;
- you are migrating a workflow and need to compare feature coverage before committing.
Using both in an organization is not inherently a problem. The problem is failing to document which identity, policy, and bill applies to each workflow.
A managed workspace is a separate choice
A managed agent workspace answers where project files, sessions, runtimes, and collaboration live. It does not turn an API key into a ChatGPT subscription or create Codex Cloud entitlement.
Agent.Space is an independent managed workspace, not OpenAI, an OpenAI subscription, a reseller, a shared account, or a way around OpenAI's regional, account, payment, or usage rules. Before using any managed Codex path, verify the current harness support, credential ownership, model choices, usage owner, and commercial terms in first-party product materials.
The overview of how Agent.Space works explains the workspace layer without changing the upstream authentication decision.
If you are comparing the same access question for Anthropic's agent, see whether Claude Code can be used without Pro or Max. The official requirements differ, so do not transfer a Codex answer to Claude Code.
Common mistakes to avoid
- Calling API-key Codex free: an API account is usage-based and requires a valid billing path.
- Assuming Plus pays the API bill: ChatGPT and Platform billing are separate.
- Expecting an API key to unlock Codex Cloud: the cloud product requires ChatGPT sign-in.
- Sharing a personal key: the key grants billable access to its owning project and must be treated as a secret.
- Choosing only by token price: tool loops, retries, and review time affect cost per accepted result.
- Treating a managed workspace as an upstream subscription: workspace and model entitlement are different layers.
The takeaway
You do not need a ChatGPT subscription to use supported local Codex surfaces. An OpenAI API key can authenticate the local desktop app, Codex CLI, or IDE extension, and the owning API project pays for usage.
You do need ChatGPT sign-in for Codex Cloud, and API-key sessions can lack features that depend on ChatGPT workspace or cloud services. Choose the execution surface first, identify the account that should own the bill and policy, then verify the exact feature and model under that sign-in method.
FAQ
Can I use Codex CLI without ChatGPT Plus?
Yes. OpenAI documents API-key authentication for Codex CLI. You still need an eligible OpenAI Platform account, a valid API key, and API billing for the model usage.
Is Codex free with an API key?
No. API-key usage is billed to the owning OpenAI API organization or project at current API rates. It is separate from a ChatGPT subscription.
Can an API key access Codex Cloud?
No. OpenAI's current authentication documentation says Codex Cloud requires ChatGPT sign-in.
Does ChatGPT Plus include OpenAI API usage?
No automatic shared balance should be assumed. ChatGPT subscription billing and OpenAI Platform API billing are separate paths.
Can I use an API key for Codex automation?
OpenAI supports API-key authentication for trusted programmatic Codex CLI workflows such as private CI/CD. Secure the key, restrict the environment, set budgets, and do not expose agent execution to untrusted public input.