# rpk ai run codex

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [agentic-data-plane-full.txt](https://docs.redpanda.com/agentic-data-plane-full.txt)

---
title: rpk ai run codex
latest-operator-version: v26.2.1
latest-console-tag: v3.9.0
latest-connect-version: 4.104.0
latest-redpanda-tag: v26.2.1
docname: rpk/rpk-ai/rpk-ai-run-codex
page-component-name: agentic-data-plane
page-version: master
page-component-version: master
page-component-title: Agentic Data Plane
page-relative-src-path: rpk/rpk-ai/rpk-ai-run-codex.adoc
page-edit-url: https://github.com/redpanda-data/adp-docs/edit/main/modules/reference/pages/rpk/rpk-ai/rpk-ai-run-codex.adoc
description: Launch the OpenAI Codex CLI with its model traffic routed through the Redpanda AI gateway for the current <code>rpk</code> ai environment. <code>rpk</code> ai generates a throwaway Codex config in a temporary CODEX_HOME, points it at the gateway's OpenAI-compatible Responses endpoint for the chosen provider, and wires Codex's bearer to <code>rpai auth token</code> so it refreshes itself for the life of the session.
page-git-created-date: "2026-06-25"
page-git-modified-date: "2026-08-06"
---

<!-- Source: https://docs.redpanda.com/agentic-data-plane/reference/rpk/rpk-ai/rpk-ai-run-codex.md -->

Launch the OpenAI Codex CLI with its model traffic routed through the Redpanda AI gateway for the current `rpk` ai environment.

`rpk` ai generates a throwaway Codex config in a temporary CODEX\_HOME, points it at the gateway’s OpenAI-compatible Responses endpoint for the chosen provider, and wires Codex’s bearer to `rpk ai auth token` so it refreshes itself for the life of the session. Your own `~/.codex` config is never read or modified, and no token is written to disk.

The launch directory is auto-trusted under a workspace-write sandbox (approval\_policy=on-request) so the fresh CODEX\_HOME doesn’t prompt for trust on every run; pass `--no-auto-trust` to keep Codex’s normal first-run trust prompt.

Only openai / openai\_compatible providers are supported (Codex speaks the OpenAI Responses API). Pass Codex’s own flags after a literal --:

```text
rpk ai run codex -L openai -m gpt-5.3-codex -e high -- --ask-for-approval never
```

## [](#usage)Usage

```bash
rpk ai run codex [flags]
```

## [](#flags)Flags

| Value | Type | Description |
| --- | --- | --- |
| --codex-home | string | persistent CODEX_HOME dir (default: a throwaway temp dir); its config.toml is regenerated each run and the dir is tightened to 0700; your real ~/.codex is refused. |
| -e, --effort | string | model reasoning effort: minimal|low|medium|high (omit to let Codex use its default). |
| -L, --llmprovider | string | aigw LLM provider name to route through (must be openai/openai_compatible). |
| -m, --model | string | model id to use (must be in the provider’s allowlist); omit to let Codex pick its default. |
| --no-auto-trust | bool | do not pre-trust the launch directory; let Codex show its normal first-run trust prompt instead (default: the launch dir is auto-trusted under a workspace-write sandbox). |
| --print-config | bool | print the generated Codex config.toml and exit (no gateway call, no codex needed). |

## [](#global-flags)Global flags

| Value | Type | Description |
| --- | --- | --- |
| --config | string | Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml. |
| -X, --config-opt | stringArray | Override rpk configuration settings; -X help for detail or -X list for terser detail. |
| --ignore-profile | bool | Ignore rpk.yaml and redpanda.yaml; use default settings. |
| --profile | string | rpk profile to use. |
| -v, --verbose | bool | Enable verbose logging. |