A Bearer token authenticates every /api/* endpoint — devices, wiki, files. The same token is used by both the relay bridge (device control) and the wiki bridge (canonical wiki I/O).
| Token | Format | Created | Last used | Actions |
|---|---|---|---|---|
| Loading… | ||||
One-shot install — adds the marketplace, installs codex-mcp-server, and you're done:
Nothing to download and no token to paste. In Claude Code, run:
It prints a link with the code already in it, plus the code on its own.
Open that printed link, approve, then run login once more to finish. You can also go to the
device approval page directly and type the code in.
Needs codex-mcp-server 0.6.0 or newer — that is where login
was added. On anything older the tool does not exist; run /plugin update, or install it
fresh with the commands above.
The token lands in ~/.claude/channels/codex-mcp/token (0600) and the
running server picks it up immediately — no restart, no /reload-plugins.
Confirm with /mcp (codex shows connected) or
mcp__codex__wiki_search "test".
An environment variable always wins over the token file. If one of these is set — commonly left behind in a shell rc by older setup instructions — then writing the file changes nothing, and a setup script will report success while the plugin silently keeps using the old value:
Check for them, then remove any you find from your shell profile and open a new terminal:
On Windows, in PowerShell:
login detects this for you: when a variable is shadowing, it names the
one to unset instead of pretending the new token took effect.
Use this only where login cannot: no browser on the machine, or provisioning many
machines non-interactively. It writes the same file the device flow does, but hands you a raw
bearer token to handle and needs a restart afterwards.
Then run it:
After running: restart Claude Code (or /reload-plugins), then
/mcp to confirm. If codex still authenticates as before, see
If it still uses your old token above.
The codex-dev plugin gives you a safe, sandboxed loop to build and run your own apps on your assigned Codex — deploy_dev_app → reload_dev_apps → read_dev_log. Apps run as a non-root developer user (no root, no shell, no TPM), scoped to the device(s) assigned to you.
Full walkthrough: Help → Building Codex Apps.
One-shot install — note this is the codex-sdk marketplace, not the one the Codex MCP tab uses:
Run the setup script — it configures codex-dev with your token and assigned device serial baked in directly. No shell-rc edits, no export, no restart dance:
After running: start Claude Code (or open a new session if one's already running) — run /mcp, codex-dev should appear connected already. Your token can't do root device control or use legion-chat — that's enforced server-side. No device assigned yet? The script will tell you to ask an admin first.