CodexBridge

Keyless Microsoft Entra ID auth for OpenAI Codex CLI against Azure OpenAI / Microsoft Foundry.

In enterprise environments where disableLocalAuth: true is set on the Azure OpenAI resource, API keys are off and Entra ID is the only authentication path. Codex CLI does not natively document Entra support, but it does ship a command-backed bearer token mechanism that can shell out to az account get-access-token — and that path was validated end-to-end on 2026-04-23 against a live Azure resource. Research findings are in docs/PLAN.md and docs/RESEARCH-NOTES.md.

➡ Start here

New-machine setup guide → — everything a fresh developer machine needs, copy-paste, ~10 minutes end to end.

Two paths

Path	When	How
Phase 0 (primary, no code needed)	Default. Validated works in practice.	Follow docs/keyless-codex-setup.md. No bridge runs.
MC contingency (this package)	Only if a future Azure change rejects Codex's x-codex-* headers	pip install -e . then python -m codexbridge --upstream https://YOUR_RESOURCE.openai.azure.com and switch Codex to examples/config.contingency.toml.

What the proxy does

A thin ASGI reverse proxy bound to 127.0.0.1:8787. On each inbound request it:

1. Strips x-codex-*, x-stainless-*, api-key, any inbound Authorization, and hop-by-hop headers.
2. Acquires an Entra token via AzureCliCredential (scope https://cognitiveservices.azure.com/.default by default; override with CODEXBRIDGE_SCOPE).
3. Injects Authorization: Bearer <token> and forwards to Azure.
4. Streams the response verbatim — SSE chunks pass through untouched.

The proxy never logs token values, header values, or request/response bodies. It refuses to bind a non-loopback address unless CODEXBRIDGE_ALLOW_REMOTE_BIND=1 is set.

Development

pip install -e '.[dev]'
pytest

Background

• docs/keyless-codex-setup.md — user-facing setup guide (M1a).
• docs/PLAN.md — research findings and build plan.
• docs/RESEARCH-NOTES.md — evidence from Codex source and MS Learn.