Create an AI Model Provider for OpenAI and an AI Model with the agentic capability that targets the OpenAI Responses API, then point Codex CLI’s OPENAI_BASE_URL at your local AI Gateway endpoint so all requests pass through the gateway for monitoring and control.
This is a Konnect tutorial and requires a Konnect personal access token.
Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
Export your token to an environment variable:
export KONNECT_TOKEN='YOUR_KONNECT_PAT'Run the AI Gateway quickstart script to automatically provision a control plane and data plane in Kong Konnect, and configure your environment:
curl -Ls https://get.konghq.com/ai | bash -s -- -k $KONNECT_TOKEN This sets up a AI Gateway control plane named ai-quickstart, provisions a local data plane, and prints out the following environment variables export:
export AI_GATEWAY_ID=your-gateway-id
export KONNECT_TOKEN=$KONNECT_TOKEN
export KONNECT_CONTROL_PLANE_NAME=ai-quickstart
export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com
export KONNECT_PROXY_URL='http://localhost:8000'Copy and paste these into your terminal to configure your session.
This tutorial uses kongctl to manage Konnect resources programmatically. We recommend keeping kongctl up to date with the latest version (1.13.0).
Verify the installation:
kongctl version export OPENAI_API_KEY='<YOUR_OPENAI_API_KEY>'
export OPENAI_AUTH_HEADER='Bearer $OPENAI_API_KEY'Install Node.js 18+ (verify with node --version), then install the OpenAI Codex CLI:
npm install -g @openai/codexCreate an AI Model Provider entity to define your connection and store your authentication credentials.
Create an AI Model entity to declare which upstream models are available, configure how client requests are routed, and specify which AI Model Provider to use.
kongctl apply -f - --auto-approve --pat "$KONNECT_TOKEN" << 'EOF'
ai_gateway_model_providers:
- ref: openai
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: openai
type: openai
display_name: "OpenAI"
config:
auth:
type: basic
headers:
- name: Authorization
value: !secret {source: !env OPENAI_AUTH_HEADER}
ai_gateway_models:
- ref: codex-openai
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: codex-openai
display_name: "Codex - OpenAI Responses API"
type: model
enabled: true
formats: [{ type: openai }]
config:
route:
paths:
- /
model:
body_param: model
values:
- codex-openai
capabilities: [agentic]
targets:
- name: gpt-5.4
provider: openai
config:
type: openai
upstream_url: "https://api.openai.com/v1/responses"
EOFIn this example, we’re setting up the AI Model Provider with:
type: openai: Specifies that this provider connects using OpenAI’s standard API format.config.auth.headers[0].value: !secret {source: !env OPENAI_AUTH_HEADER}: Loads the API key from your environment at apply time so it is not embedded in the config, and kongctl redacts it in plan and diff output.In this example, we’re setting up the AI Model with:
capabilities: [agentic]: Routes requests to the OpenAI Responses API, which the Codex CLI uses.formats: [{ type: openai }]: Accepts OpenAI-format requests.config.route.model: { body_param: model, values: [codex-openai] }: The model name the Codex CLI sends in each request.route.paths: [/]: The base path Codex points at. The Responses API is served at /responses.Run a simple command to confirm traffic flows through AI Gateway to OpenAI:
codex \
--config model="codex-openai" \
--config model_provider="my-gateway" \
--config model_providers.my-gateway.name="AI Quickstart" \
--config model_providers.my-gateway.base_url="http://localhost:8000/" \
--config model_providers.my-gateway.env_key="OPENAI_API_KEY" \
--config model_providers.my-gateway.wire_api="responses"And ask a question to confirm that requests reach AI Gateway.
Tell me about the Madrid Skylitzes manuscript.When prompted for network access, select Yes, proceed. Codex routes the request through AI Gateway to the OpenAI Responses API and returns the model’s response, giving you monitoring and control over all Codex LLM traffic.
The Codex CLI requires
OPENAI_API_KEYto be set even though the real key lives on the AI Gateway, so setting a placeholder is fine. You may be prompted to confirm this in the UI.