Route OpenAI Codex CLI traffic through Kong AI Gateway

First, let’s configure the AI Proxy Advanced plugin. In this setup, we use the Responses route because the Codex CLI calls it by default. We don’t hard-code a model in the plugin — Codex sends the model in each request. We also raise the body size limit to 128 KB to support larger prompts.

echo '
_format_version: "3.0"
plugins:
  - name: ai-proxy-advanced
    service: codex-service
    config:
      genai_category: text/generation
      llm_format: openai
      max_request_body_size: 131072
      model_name_header: true
      response_streaming: allow
      balancer:
        algorithm: round-robin
        tokens_count_strategy: total-tokens
        latency_strategy: tpot
        retries: 3
      targets:
      - route_type: llm/v1/responses
        auth:
          header_name: Authorization
          header_value: Bearer ${{ env "DECK_OPENAI_API_KEY" }}
        logging:
          log_payloads: false
          log_statistics: true
        model:
          provider: openai
' | deck gateway apply -

To ensure that Codex forwards clean, predictable requests to OpenAI, we configure a Request Transformer plugin. This plugin normalizes the upstream URI and removes any extra path segments, so only the expected route reaches the OpenAI endpoint. This small guardrail avoids malformed paths and keeps the proxy behavior consistent.

echo '
_format_version: "3.0"
plugins:
  - name: request-transformer
    service: codex-service
    config:
      replace:
        uri: "/"
' | deck gateway apply -

Now, we can pre-validate our current configuration:

curl -X POST "$KONNECT_PROXY_URL/codex" \
     -H "Content-Type: application/json" \
     --json '{
       "model": "gpt-4o",
       "input": [
         {
           "role": "user",
           "content": "Ping"
         }
       ]
     }'

curl -X POST "http://localhost:8000/codex" \
     -H "Content-Type: application/json" \
     --json '{
       "model": "gpt-4o",
       "input": [
         {
           "role": "user",
           "content": "Ping"
         }
       ]
     }'

Now, let’s open a new terminal window and export the variables that the Codex CLI will use. We set a dummy API key here just to confirm the variable exists, and point OPENAI_BASE_URL to the local proxy endpoint where we will route LLM traffic from Codex CLI:

export OPENAI_API_KEY=sk-xxx
export OPENAI_BASE_URL=http://localhost:8000/codex

export OPENAI_API_KEY=sk-xxx
export OPENAI_BASE_URL=$KONNECT_PROXY_URL/codex

Finally, to see the exact payloads traveling between Codex and the AI Gateway, let’s attach a File Log plugin to the service. This gives us a local log file so we can inspect requests and responses as Codex runs through Kong.

echo '
_format_version: "3.0"
plugins:
  - name: file-log
    service: codex-service
    config:
      path: "/tmp/file.json"
' | deck gateway apply -

Let’s test our Codex CLI set up now:

1. In the terminal where you exported your environment variables, run:

   codex
   

   Copied!

   You should see:

    ╭───────────────────────────────────────────╮
    │ >_ OpenAI Codex (v0.55.0)                 │
    │                                           │
    │ model:     gpt-5-codex   /model to change │
    │ directory: ~                              │
    ╰───────────────────────────────────────────╯
   
     To get started, describe a task or try one of these commands:
   
     /init - create an AGENTS.md file with instructions for Codex
     /status - show current session configuration
     /approvals - choose what Codex can do without approval
     /model - choose what model and reasoning effort to use
     /review - review any changes and find issues
   

   Copied!

   {.no-copy-code}

2. Run a simple command to call Codex using the gpt-4o model:

   codex exec --model gpt-4o "Hello"
   

   Copied!

   Codex will prompt:

     Would you like to run the following command?
   
     Reason: Need temporary network access so codex exec can reach the OpenAI API
   
     $ codex exec --model gpt-4o "Hello"
   
   › 1. Yes, proceed
     2. Yes, and don't ask again for this command
     3. No, and tell Codex what to do differently
   

   Copied!

   {.no-copy-code}

   Select Yes, proceed and press Enter.

   Expected output:

   • Ran codex exec --model gpt-4o "Hello"
     └ OpenAI Codex v0.55.0 (research preview)
       --------
       … +12 lines
       6.468
       Hi there! How can I assist you today?
   
   ─ Worked for 9s ────────────────────────────────────────────────────────────────
   
   • codex exec --model gpt-4o "Hello" returned: “Hi there! How can I assist you today?”
   

   Copied!

   {.no-copy-code}

3. Check that LLM traffic went through Kong AI Gateway:

   docker exec kong-quickstart-gateway cat /tmp/file.json | jq
   

   Copied!

   Look for entries similar to:

   {
     ...
     "ai": {
       "proxy": {
         "tried_targets": [
           {
             "ip": "0000.000.000.000",
             "route_type": "llm/v1/responses",
             "port": 443,
             "upstream_scheme": "https",
             "host": "api.openai.com",
             "upstream_uri": "/v1/responses",
             "provider": "openai"
           }
         ]
       }
     }
     ...
   }
   

   Copied!