Connect Codex

These steps work for the Codex CLI, the Codex IDE extension and the ChatGPT desktop app, because they share ~/.codex/config.toml. See the Codex MCP documentation for more options.

Option 1: installation token

1. Store the token in an environment variable that Codex can read. Codex stores only the variable name, not the token.

   macOS or Linux

   # Add this line to your shell profile
   export INSIDE_GATEWAY_TOKEN="igw_live_..."

   Windows PowerShell

   # Persists for new terminals
   [Environment]::SetEnvironmentVariable("INSIDE_GATEWAY_TOKEN", "igw_live_...", "User")

2. Add the server.

   codex mcp add inside-gateway --url https://api.inside.chat/mcp --bearer-token-env-var INSIDE_GATEWAY_TOKEN

   Or edit ~/.codex/config.toml directly. You can also use a project’s .codex/config.toml, for trusted projects only:

   [mcp_servers.inside-gateway]
   url = "https://api.inside.chat/mcp"
   bearer_token_env_var = "INSIDE_GATEWAY_TOKEN"
   # Ask before any tool that isn't marked read-only.
   default_tools_approval_mode = "writes"
   startup_timeout_sec = 20
   tool_timeout_sec = 60

3. Restart Codex, or your editor for the IDE extension, so it picks up the new environment variable.

4. Check the connection. Run codex mcp list, or type /mcp in the Codex terminal UI.

Option 2: short-lived OAuth tokens

Codex can run a local command to produce request headers, and runs it again when the server returns 401. Gateway OAuth tokens expire after 15 minutes, so Codex fetches a new one automatically.

1. Save the helper script inside-gateway-mcp-headers.mjs somewhere stable, for example ~/.codex/inside-gateway-mcp-headers.mjs. It needs Node.js 18 or later.

2. Set the credential variables. Set INSIDE_CLIENT_ID to the credential ID and INSIDE_CLIENT_SECRET to the credential’s token. Optionally set INSIDE_SCOPES, for example "website_read conversation_read", to request fewer scopes.

3. Configure the server without bearer_token_env_var, because a configured bearer token takes precedence over helper headers:

   [mcp_servers.inside-gateway]
   url = "https://api.inside.chat/mcp"
   http_headers_helper = "node /Users/me/.codex/inside-gateway-mcp-headers.mjs"
   default_tools_approval_mode = "writes"

   Use an absolute path. If the path contains spaces, wrap the command in a small shell or batch script and point http_headers_helper at that script.

The helper prints a single JSON object such as {"Authorization":"Bearer igw_live_..."} and never writes the secret anywhere.

Try it

Ask Codex:

Use the inside-gateway MCP server. Call gateway_context, read the overview guide, then list my websites and the capabilities for the first one.

Don't use codex mcp login

codex mcp login needs dynamic client registration and a local callback, which the Gateway doesn’t support. If Codex says the server needs OAuth, it didn’t find a bearer token: check bearer_token_env_var or http_headers_helper, then restart Codex.

Keep a human in the loop

• default_tools_approval_mode = "writes" asks before any tool that isn’t marked read-only.
• List write tools in disabled_tools to hide them completely.
• Or simply don’t grant write scopes. See writes from agents.