1. Create a Codex identity
In the tenant portal, create an API key named for the employee and client—for example Steele-Codex-Mac. Add team and project tags for reporting and Duplicate Guard.
2. Export the key
On macOS or Linux:
export SAFETYROUTER_API_KEY='sr_live_...'In PowerShell:
$env:SAFETYROUTER_API_KEY='sr_live_...'3. Configure the provider
Add the provider to your user-level ~/.codex/config.toml. Replace the hostname and model with values enabled by your tenant.
model = "provider/model-name"
model_provider = "safetyrouter"
[model_providers.safetyrouter]
name = "SafetyRouter"
base_url = "https://your-company.safetyrouter.io/v1"
env_key = "SAFETYROUTER_API_KEY"
wire_api = "responses"
stream_idle_timeout_ms = 900000Codex does not allow project-local configuration to replace model-provider or authentication settings. Put this provider in ~/.codex/config.toml, not the repository's .codex/config.toml.
4. Start Codex
codexSafetyRouter converts Codex Responses input into the governed model path, inspects the complete output and proposed local tool calls, and only then emits compatible Responses events to Codex.
Core text and local function/custom-tool workflows are supported. Responses-hosted web search, image/file input, background responses, and server-managed conversation objects are not forwarded in this release.
Configuration and streaming behavior verified against the official Codex custom-provider documentation and tested with the current installed Codex CLI.