How to Set Up OpenAI / Codex CLI Authentication
Configure OpenAI or Codex CLI access on your CRHQ satellite. Choose between an API key or your ChatGPT subscription — only one method needs to be active at a time.
Overview
CRHQ satellites can use OpenAI models (including Codex CLI) for agent tasks. To enable this, you need to authenticate with OpenAI using one of two methods:
| Method | Best For | What You Need |
|---|---|---|
| API Key (recommended) | Reliable, always-on access | An OpenAI API key from platform.openai.com |
| ChatGPT Subscription | Using your existing Plus/Team plan | A ChatGPT account with Device Code Authorization enabled |
Only one method needs to be active at a time. You can switch between them whenever you want.
Method 1: API Key (Recommended)
This is the simplest and most reliable way to connect.
1. Get Your API Key
Go to platform.openai.com/api-keys and create a new secret key. Copy it — you won't be able to see it again.
Tip: Use a dedicated key for CRHQ so you can rotate or revoke it independently.
2. Add It to Your Satellite
- Open your satellite dashboard
- Go to Settings → System
- Scroll to the OpenAI section
- Paste your API key into the field
- Click Save
That's it. Your satellite will use this key for all OpenAI and Codex CLI requests.
Method 2: ChatGPT Subscription
If you have a ChatGPT Plus or Team subscription, you can authenticate using your ChatGPT account instead of a separate API key. This uses OpenAI's device code authorization flow.
1. Enable Device Code Authorization in ChatGPT
This step is required — the sign-in flow won't work without it.
- Go to chatgpt.com and log in
- Open Settings (bottom-left menu)
- Go to Security
- Find Device Code Authorization and enable it
Warning: If you skip this step, the sign-in flow on your satellite will fail. Make sure Device Code Authorization is toggled on before proceeding.
2. Sign In on Your Satellite
- Open your satellite dashboard
- Go to Settings → System
- In the OpenAI section, click Sign in with ChatGPT
- Follow the device code flow — you'll be given a code and a link to enter it on OpenAI's site
- Authorize the device when prompted
Once authorized, your satellite will use your ChatGPT subscription for OpenAI requests.
Switching Between Methods
Both methods appear in Settings → System → OpenAI. Only one can be active at a time.
- To switch, configure the method you want to use, then click Make Active next to it
- The previously active method stays saved — you can switch back at any time without re-entering credentials
- There's no need to disconnect or remove the inactive method
Troubleshooting
API key isn't working
- Make sure the key starts with
sk-and hasn't been revoked - Check that your OpenAI account has available credits or an active billing plan
- Try generating a fresh key at platform.openai.com/api-keys
ChatGPT sign-in fails
- Confirm Device Code Authorization is enabled in your ChatGPT Security settings — this is the most common issue
- Make sure you're completing the authorization within the time limit shown on screen
- Try signing out and back into chatgpt.com, then retry
Models aren't available after authenticating
- After changing the active method, give it a few seconds to take effect
- If using ChatGPT subscription, note that available models depend on your subscription tier