Agentic Data Plane

rpk ai run codex

Launch the OpenAI Codex CLI with its model traffic routed through the Redpanda AI gateway for the current rpk ai environment.

rpk ai generates a throwaway Codex config in a temporary CODEX_HOME, points it at the gateway’s OpenAI-compatible Responses endpoint for the chosen provider, and wires Codex’s bearer to rpk ai auth token so it refreshes itself for the life of the session (with an ADP API key, rpk ai auth api-key prints the stored key). Your own ~/.codex config is never read or modified, and no token is written to disk.

The launch directory is auto-trusted under a workspace-write sandbox (approval_policy=on-request) so the fresh CODEX_HOME doesn’t prompt for trust on every run; pass --no-auto-trust to keep Codex’s normal first-run trust prompt.

Only openai / openai_compatible providers are supported (Codex speaks the OpenAI Responses API). Pass Codex’s own flags after a literal --:

rpk ai run codex -L openai -m gpt-5.3-codex -e high -- --ask-for-approval never

Usage

rpk ai run codex [flags]

Flags

Value Type Description

--api-key

string

authenticate the session with an ADP API key: ask (ask before creating one), yes (create one without asking, also without a terminal), no (always use your login token).

--codex-home

string

persistent CODEX_HOME dir (default: a throwaway temp dir); its config.toml is regenerated each run and the dir is tightened to 0700; your real ~/.codex is refused.

-e, --effort

string

model reasoning effort: minimal|low|medium|high (omit to let Codex use its default).

-L, --llmprovider

string

aigw LLM provider name to route through (must be openai/openai_compatible).

-m, --model

string

model id to use (must be in the provider’s allowlist); omit to let Codex pick its default.

--no-auto-trust

bool

do not pre-trust the launch directory; let Codex show its normal first-run trust prompt instead (default: the launch dir is auto-trusted under a workspace-write sandbox).

--print-config

bool

print the generated Codex config.toml and exit (no gateway call, no codex needed).

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.