About OpenAI Codex
Codex CLI is OpenAI's coding agent, and it runs in a terminal. It reads the repository you launch it in, proposes changes, runs commands and tests, and asks for your approval according to the approval mode you choose. The project is open source and published on GitHub.
Running it on a VPS rather than a workstation has a practical benefit: the agent lives on an always-on machine with a stable network connection, and you drive it over SSH from any computer. Long tasks (refactoring, migrations, fixing failing tests) no longer tie up your laptop.
After delivery, the server has a system user codex with a bash shell and passwordless sudo, plus git, curl and ca-certificates. Codex CLI is installed for that user with the official install script, without Node.js. The SSH keys authorized for root are copied to codex, so you can log in with that account directly. Authentication is not done for you: it is interactive and you start it once you are connected.
What you can do with OpenAI Codex
Coding agent in your terminal
Codex reads your repository, proposes file changes and runs commands in the current directory. You stay in control through the approvals it requests before sensitive actions.
Official install, no Node.js
The install script published with OpenAI's GitHub releases is run for the codex user. There is no Node.js runtime to install or maintain.
Dedicated user with direct SSH
A codex account is created with a locked password. Your root SSH keys are copied to it, so key-based login works immediately.
Device-code authentication
The codex login --device-auth command shows a code to enter in your browser. It suits a server with no graphical interface.
Git and basic tools included
git, curl and ca-certificates are installed. You can clone your repositories and put the agent to work on them from the first login.
Get started with OpenAI Codex
From order to production in a few minutes.
- 1
Order the VPS with Codex ticked
Choose a Linux VPS in Paris or Frankfurt (Debian 12, Debian 13, Ubuntu 20.04, 22.04 or 24.04). In the "Applications" tab of the order form, tick OpenAI Codex, then add your SSH key if the form offers it.
- 2
Connect over SSH as the codex user
Once the server is delivered, open an SSH session with the codex account. It inherits root's authorized keys: if you did not add a key at order time, log in first with the access you were given and add your key to /home/codex/.ssh/authorized_keys.
Bashssh codex@SERVER_IP - 3
Authenticate Codex and run it in a repository
Start the device-code login, open the address shown in your browser and enter the code. Then move into a git repository and start the agent.
Bashcodex login --device-auth git clone https://github.com/YOUR_ORG/YOUR_REPO.git && cd YOUR_REPO codex - 4
Secure the server before regular use
Switch SSH to key-only access and restrict the firewall to port 22. If several people have access to the server, consider replacing the codex account's passwordless sudo.
Bashsudo apt install -y ufw sudo ufw allow 22/tcp sudo ufw enable sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config sudo systemctl reload ssh
OpenAI Codex use cases
Always-available coding agent
Start a long refactor or a dependency upgrade, disconnect, then pick the session back up later from another computer.
Isolated environment for sensitive repos
Keep the code and deploy keys on a server dedicated to the agent instead of your personal machine, under a separate system account.
Automated maintenance tasks
Have Codex write fixes, tests or migration scripts on a clone of the repository, then review the diff before you push.
Shared remote workstation for a team
A small team connects to the same server to hand repetitive tasks to Codex, each person using their own SSH key.
OpenAI Codex FAQ
No. The recipe uses the project's official install script, which does not require Node.js. You get the codex command directly, for the user of the same name.
More about OpenAI Codex
Authentication
Codex supports signing in with a ChatGPT account or with an OpenAI API key. The recipe does not log in for you: run codex login --device-auth as the codex user. The device-code flow means you do not need a browser on the server, since you confirm the code from your own computer.
Keeping the session alive
A dropped SSH connection interrupts the agent mid-task. Install a terminal multiplexer, for example sudo apt install -y tmux, start tmux, then run codex inside it. You can detach and resume later with tmux attach.
Permissions and security
The codex account has passwordless sudo. That is handy for installing dependencies, but it gives full control of the machine to anyone who holds its SSH key. Protect that key, and use the server only with repositories whose commands you are willing to let the agent run. Keep a cautious approval mode until you trust your workflow.
Updates
Codex CLI moves quickly. To get the latest version, run the official install script used at delivery again as the codex user: curl -fsSL https://github.com/openai/codex/releases/latest/download/install.sh | sh. Read the project's release notes before updating a server you use in production.
Going further
For a more powerful machine or several agents in parallel, compare the Linux VPS plans. Step-by-step guides are available in the tutorials section.
