Codex Gateway · Entra JWT → OpenAI

#Architecture

Codex authenticates with an Entra ID token as Bearer (CODEX_AGW_TOKEN), the gateway validates it Strict against Entra JWKS, then injects the OpenAI key upstream. Model is not pinned — Codex sends it per request.

Path is / on this dedicated Gateway so Codex can call {base}/v1/responses. The kagent OpenAI path stays on agentgateway-proxy at :30160/openai (gpt-5.5 pinned — do not steal it). Sibling Claude Desktop path: claude-desktop.html.

#Live endpoint

Bare-metal NodePort on worker 172.16.10.155. Codex allows plain HTTP off loopback, so the LAN URL is valid. Live Service ports: HTTP 80:31928/TCP, HTTPS 443:31540/TCP.

#Entra app

Public client already registered — do not recreate.

#Codex CLI + ChatGPT desktop config

base_url must end in /v1. CODEX_AGW_TOKEN must be an Entra ID token for agw-codex (gateway JWT aud = client ID). Codex sends it as Authorization: Bearer. Access tokens fail.

~/.codex/config.toml

model_provider = "agentgateway"

[model_providers.agentgateway]
name = "OpenAI via agentgateway"
base_url = "http://172.16.10.155:31928/v1"
wire_api = "responses"
env_key = "CODEX_AGW_TOKEN"

Loopback variant: base_url = "http://127.0.0.1:18790/v1".

CLI one-shot

From Solo Codex docs plus env_key:

export AGENTGATEWAY_BASE_URL="http://172.16.10.155:31928/v1"
export CODEX_AGW_TOKEN='<entra id_token>'

codex -c 'model_provider="agentgateway"' \
  -c 'model_providers.agentgateway.name="OpenAI via agentgateway"' \
  -c "model_providers.agentgateway.base_url=\"${AGENTGATEWAY_BASE_URL}\"" \
  -c 'model_providers.agentgateway.wire_api="responses"' \
  -c 'model_providers.agentgateway.env_key="CODEX_AGW_TOKEN"' \
  "Hello"

Mint an ID token

Device-code against the public client (no secret). Copy id_token, not access_token.

TENANT=8635e970-2205-4189-bc77-77519ff5064f
CLIENT=e862e87d-d284-46a8-bf70-30ac7dba351e

curl -sS -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/devicecode" \
  -d "client_id=${CLIENT}" \
  -d "scope=openid profile email offline_access"

# complete user_code in a browser, then:
curl -sS -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
  -d "client_id=${CLIENT}" \
  -d "device_code=${DEVICE_CODE}"

ChatGPT desktop Codex

Same provider block. Back up and replace the user-level config, then restart the app — or Settings → Configuration → Open config.toml. Export CODEX_AGW_TOKEN in the environment that launches the app.

{
  "model_provider": "agentgateway",
  "model_providers": {
    "agentgateway": {
      "name": "OpenAI via agentgateway",
      "base_url": "http://172.16.10.155:31928/v1",
      "wire_api": "responses",
      "env_key": "CODEX_AGW_TOKEN"
    }
  }
}

JSON-ish equivalent of the TOML (the app file is still TOML). Profile form: codex --profile agentgateway with ~/.codex/agentgateway.config.toml.

#Critical callouts

#Cluster resources

GitOps under config/ via Argo app agentgateway-config. Push + sync is enough. File paths link to GitHub main.

#Links

Lab page, repo, proxy script, GitOps manifests, and official Codex docs.

• Proxy · scripts/codex-lab-proxy.py
• Docs · docs/codex-gateway.md
• Gateway · config/gateway/codex-gateway.yaml
• Route · config/routes/codex-route.yaml
• Backend · config/backends/openai-codex.yaml
• JWT policy · config/policies/codex-jwt-auth.yaml