Codex silently switches to API key auth when environment variable is present, causing unintended billing

[garyamorris]

What version of the Codex App are you using (From “About Codex” dialog)?

Latest (Updated several times) 26.422.62136

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Windows (also observed in Debian-based environments via OpenClaw)

---

What issue are you seeing?

When developing with the OpenAI SDK, I have an API key configured in my environment variables. The Codex app intermittently switches from my ChatGPT plan to API key authentication without clear indication. This results in unintended usage of my paid API credits.

This issue is not limited to Windows. It also occurs in OpenClaw instances running on Debian, where Codex CLI tools are installed and an API key is present in the system PATH/environment. In these environments, the same silent fallback to API key authentication is observed.

---

What steps can reproduce the bug?

1. Set an OPENAI_API_KEY in system environment variables (e.g. for SDK development)
2. Log into Codex using a ChatGPT account with an active plan
3. Start using Codex normally
4. At some point (e.g. restart, session change, CLI/tool invocation, or running within OpenClaw), Codex begins using the API key instead of the ChatGPT session

---

What is the expected behavior?

• Codex should default to ChatGPT session authentication when the user is logged in
  OR
• Clearly prompt the user before switching authentication modes
  OR
• Provide a persistent, highly visible indicator of which billing mode is active

---

What is the actual behavior?

• Codex silently switches to API key authentication
• No obvious warning or confirmation
• Leads to unintended API spend

---

Additional information

Impact

• High — causes unexpected financial cost
• Easy to miss during normal development flow
• Particularly problematic for developers who must have API keys set locally
• Amplified in OpenClaw / remote CLI environments, where auth context is less visible

---

Suggested Fixes

• Explicit auth mode toggle (ChatGPT vs API)
• Persistent UI indicator (e.g. “Using API key – billed per token”)
• Confirmation dialog before switching auth modes
• Option to disable API key auto-detection entirely
• Project-level or session-level auth locking

---

Environment

• Windows
• Debian (OpenClaw instances)
• OpenAI SDK in use (API key required in environment variables)
• Codex app
• Codex CLI tools installed (in Debian/OpenClaw environments)

---

Additional Context

This is especially problematic in workflows where developers are actively switching between SDK usage and Codex, as the auth mode can change without user awareness.

In OpenClaw-based setups running on Debian, where Codex CLI tooling is installed and API keys are necessarily present for automation, this behaviour becomes even more dangerous due to the lack of visibility into which auth mode is active at any given time.

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• My Codex app automatically switched to using my API and consumed my quota. #19861

Powered by Codex Action

[etraut-openai]

Codex does not pay any attention to the OPENAI_API_KEY env variable. It does support CODEX_API_KEY when it's invoked as codex exec (which is what the SDK uses). Are you perhaps defining a CODEX_API_KEY config key?

The only other theory I have for the behavior you're seeing is that your auth.json file contains both an API key and a ChatGPT auth token. Early versions of Codex allowed both of these to be written to auth.json. Many months ago, we changed the logic to support only one or the other. I wonder if your auth.json file still has both. Open ~/.codex/auth.json in an editor to validate this theory. If you see both, then delete the OPENAI_API_KEY entry. Or you can use the cli to codex logout and then run codex to log in again. This will rewrite the auth.json file.