Authorization in Codex is not only the question of "how to sign in" but also of whose billing it is, what the policy is and what is available at all. For OpenAI models the local clients support two main paths: signing in through ChatGPT and an API key. Codex cloud requires exactly ChatGPT sign-in. The login method determines not only payment but also workspace policy, retention and the availability of cloud and connector features - so it is chosen consciously, not by the first prompt that comes up.

The difference between signing in through ChatGPT and an API key is fundamental. ChatGPT sign-in ties the work to your plan and workspace controls, enables cloud capabilities and obeys the account's policy. An API key is usage-based billing, convenient for local clients, CI and programmatic integration, but it does not give the cloud part. Mixing them in one environment is easy, and the consequences are not obvious: a request may go the wrong route and to the wrong bill, so the real source is always checked.

You check the sign-in with a command, not from memory. codex login status shows the current authorization state, codex logout resets it. An important detail: the CLI and the IDE extension use a shared cached login, so a sign-in in one place is visible in the other. This is convenient but also demands attention: signing out in one client affects both, and an unexpected change of the login source is a frequent cause of "it worked yesterday and not today".

Where the credentials live is a matter of both convenience and security. They may be stored in the $CODEX_HOME/auth.json file or in the system credential store. The cli_auth_credentials_store setting forces the behavior: the value keyring chooses the system store, while auto uses it when available and otherwise falls back to the file. On shared or CI machines the system store is preferable to a file that is easier to read by accident or carry off together with the home directory.

It helps to gather the sign-in methods into a table once, to choose by the task. Below is the map: ChatGPT sign-in for interactive local work and the cloud, device code for headless and remote hosts, an API key for local clients, CI and usage-based billing. You return to this map when changing the environment: each method has its own area of use, its own billing and its own limits, and mixing them means one day being surprised by a bill or an unavailable feature.