Skip to main content
Proxy Codex CLI requests through PasteGuard with masking on Responses calls. 
/codex/*
POST /codex/responses receives PII and secrets protection and appears in the dashboard. Supporting endpoints such as /codex/models are proxied directly.
In route mode, clean Codex Responses requests are forwarded to Codex. Requests containing PII or secrets configured with route_local are blocked because PasteGuard does not convert Codex Responses traffic to a local provider format.

​
Codex CLI

Add a custom Codex model provider to ~/.codex/config.toml: 
model_provider = "pasteguard-codex"

[model_providers.pasteguard-codex]
name = "PasteGuard Codex"
base_url = "http://127.0.0.1:3000/codex"
wire_api = "responses"
requires_openai_auth = true
supports_websockets = false
Then run Codex normally: 
codex exec --skip-git-repo-check 'Reply with exactly: ok'

​
Upstream

By default, Codex requests forward to: 
providers:
  codex:
    base_url: https://chatgpt.com/backend-api/codex
Examples:
PasteGuard URLUpstream URL
/codex/responseshttps://chatgpt.com/backend-api/codex/responses
/codex/models?client_version=0.128.0https://chatgpt.com/backend-api/codex/models?client_version=0.128.0
POST /codex/responses is inspected and logged. Other Codex endpoints are direct pass-through.

​
Authentication

PasteGuard forwards the Codex CLI authorization header. This is different from /openai/v1, which is for OpenAI API-key traffic against https://api.openai.com/v1.