Codex Cloud guide (2026): set up a cloud environment in 6 steps, run coding tasks from your phone, keep secrets safe, understand the limits and pick a plan

What Codex Cloud is

Codex Cloud hands coding tasks, from investigating bugs to building features, to Codex in the cloud, and you review the work from the web, mobile or the desktop app. Each task gets its own workspace and keeps working while your computer is asleep. It arrived in the ChatGPT release notes on 2026-09-29.

• Cloud environment: the reusable setup — repositories, dependencies, tools and access settings. Codex inspects your repositories, prepares the setup and tests it with you; once published, tasks can use it.
• Task: each new task gets its own isolated workspace from the published environment, so several tasks can share one setup without stepping on each other.

Inside a task Codex edits files, runs commands and checks its work; you review the diff and test results, ask for follow-ups, then commit or open a pull request. Code Review and the Linear and GitHub integrations still run on Codex Cloud (Legacy), which OpenAI plans to deprecate.

Cloud or local: when to use Codex Cloud

Use the cloud when (OpenAI’s own list):

• The work should run remotely, such as a long job you start before leaving your desk.
• Several tasks need the same setup, each with its own working state.
• The workflow needs service credentials: network secrets send them only to allowed HTTPS services.
• You want to start or check cloud tasks from a terminal or a script.

Stay local for GitLab or self-hosted GitHub Enterprise Server repositories, computer or browser use, personal skills, or small edits where you’d rather save allowance.

Set up your first environment in 6 steps

New environments can only be created on the web or in the desktop app; on a phone you can only pick a published one. Sign in with your ChatGPT account, then follow OpenAI’s six steps:

1. Work in → Cloud → Select environment → Create environment. On the web or in the desktop app; Settings → Codex Cloud → Environments works too.
2. Select GitHub repositories (connect GitHub if prompted). GitLab and self-hosted GitHub Enterprise Server aren’t supported yet.
3. Get started: Codex inspects the repos, installs dependencies and tools, tests the workflow. It works out runtimes, package versions, tools and services by itself.
4. Supply missing access or information when asked. Say things like “use Node 20 and pnpm; the test command is pnpm test”.
5. Review the setup report, save, Publish. Saving stores the configuration; publishing captures the filesystem new tasks start from.
6. Start a new task. Every new task starts from a fresh copy of the published environment.

• You don’t write the install script. Codex records the tested setup in two fields: the install script (commands that install dependencies and prepare development assets) and the Start skill (instructions that start services and check they’re ready). Refine both in the conversation.
• To update it: Settings → Codex Cloud → Environments → the environment’s … menu → Edit. Describe the change, let Codex test it, save and Republish. Only new tasks pick up the update; existing tasks keep their own state.
• If setup fails: ask Codex to diagnose the failing command and rerun it, or select Try again. Changes to source files, manifests or lockfiles belong in a coding task first. An Unpublished badge means new tasks can’t use the environment yet.

Secrets, internet access and VPN without leaking credentials

Codex asks for values it can’t infer. In the environment configuration, select Manage beside Environment variables or Network secrets and choose the right one:

• A network secret needs a Key, a Value and Allowed domains, and its key must differ from any direct variable. Saving environment-owned secrets adds their destinations to the restricted internet allowlist.
• Our advice: put tokens in network secrets unless a program truly needs the raw value, and give each token only the permissions the task needs.
• Personal vault: Settings → Codex Cloud → Personal vault → Add, pick the type, enter the Key and your Value, and apply it to all or selected environments. A shared environment can request each person’s own values; sharing passes on the requirement, not your credential. Only requested values reach a task.

Internet access is off until you allow it. Turn on Allow Codex to access internet, pick a preset under Allow domains and add any other hosts under Additional allowed domains:

• Package managers: Common registries and download hosts: npm and Yarn, PyPI, crates.io, Go, Maven and Gradle, Ubuntu and Debian, GitHub source and releases. The usual starting point.
• Custom domains only: Only the hosts you add under Additional allowed domains, e.g. your own API or a private registry.
• All (unrestricted): No destination limits; only when the workflow genuinely needs broad access.

Allowing a domain doesn’t grant permissions in that service. Test during setup, republish, then verify in a new task. Services that filter by source IP can use OpenAI’s agent egress IP feed (openai.com/chatgpt-agents.json); the ranges are shared across customers, so keep the service’s own authentication.

Private services go through a VPN: Advanced → VPN → Add, then enter your provider’s credentials. Tailscale is the only supported provider for now. Create its auth key with both Reusable (every new task VM can join) and Ephemeral (offline devices are removed automatically). Private IPv4 subnet routes, split DNS and MagicDNS work; allow each destination in both your Tailscale access rules and the environment’s internet settings.

The phone workflow: send it, watch it, finish at your desk

Create and publish the environment on the web or desktop app first. After that:

1. Send: open Codex in the ChatGPT mobile app, pick a published environment and describe the task, e.g. “Reproduce the failing test in tests/api, fix the cause, run the whole suite and list the files you changed.”
2. Let it run: locking your phone or closing your laptop doesn’t stop it.
3. Review: check the changes and test results on the phone, ask for follow-ups, and commit or open a pull request when it’s right.
4. Finish at your desk: reopen the same task on the web or desktop app, or pull its latest diff into your local repository with codex apply. A new task starts from the published setup and doesn’t carry the earlier task’s changes.

Good phone jobs, in our experience: bugs with clear reproduction steps, missing tests, minor dependency bumps, small features from an issue. Poor ones: design changes that need your call at every step, and front-end work you’d check in a browser (browser use isn’t supported in the cloud yet).

From the terminal: codex cloud commands

# pick a task interactively and look up environment IDs
codex cloud

# submit a cloud task directly (--env is required)
codex cloud exec --env <ENV_ID> "Fix the flaky test in tests/api and run the whole suite"

# recent tasks as JSON for scripts
codex cloud list --json

# apply a task's latest diff to your local repository
codex apply <TASK_ID>

The cloud commands use the same sign-in as the main CLI and exit non-zero when a submission fails, so they script cleanly. Each extra --attempts run is another full run; keep the default of 1 when allowance is tight. In the IDE extension, /cloud runs the chat in the cloud (where available), /cloud-environment picks the environment and /local switches back. For choosing a model, see our GPT-6 Sol and Luna guide.

Limits: VM size, allowance and how cloud tasks spend it

Each cloud task runs in a VM with these default resources:

Enterprise can ask OpenAI for larger or custom VMs. A task’s saved VM state is recoverable for up to 7 days after you last start a turn or resume it, so commit what matters: saved state doesn’t replace source control.

For allowance, OpenAI only publishes per-five-hour estimates of local messages, for Plus and Standard Business:

1. Estimates, not fixed limits. Model, task size, context and reasoning all move the number.
2. Cloud tasks may use more of your allowance than local messages — OpenAI’s wording.
3. Local and cloud share one allowance, and weekly limits may also apply. A heavy cloud task and a heavy CLI session compete for the same budget.
4. The Pro plans currently have no five-hour limit in Codex.
5. Where to look: the usage dashboard at chatgpt.com/codex/settings/usage, or /status in a CLI session.
6. At the limit, the turn in progress can finish (subject to fair use), and Plus and Pro users can buy credits to keep going without upgrading.

OpenAI’s tips for stretching it: precise prompts without unnecessary context, only the relevant files, a defined output format and length, a lean (nested) AGENTS.md, and fewer MCP servers. When you do run out, compare credits with an upgrade.

Which plan: Plus, credits, Business or Pro

Who should buy what:

• Trying Codex Cloud a few times a week: Plus. On a Free or expired-Plus account, take Plus on your own account (¥185 ≈ 27.58 USDT) and keep your GitHub connection and history. For a separate work account, take ready-made Plus (¥199 ≈ 29.66 USDT) and connect GitHub there.
• Plus runs out now and then: Codex credits (¥180 ≈ 26.83 USDT per 500, 1–20 packs per order, valid 12 months). Included usage goes first; Free accounts can’t take credits.
• Hitting limits every week, or you want the bigger VM: Pro 100 (¥850 ≈ 126.68 USDT), or Pro 200 (¥1,300 ≈ 193.75 USDT) for more. At our prices, once you need 4 or more packs a month, Plus with credits costs at least as much as Pro 100.
• A team of two or more: Business seats, standard ¥220 ≈ 32.79 USDT per seat per month, premium 5× that, at least 2 in total. Standard seats share Plus’s Codex estimates; you gain the workspace, admin controls and larger VMs.

Buying through ClaudeMax

• Top-ups (Plus, Pro, Codex credits): submit the login credential the order page asks for; it’s checked before you pay, delivery usually takes 5–30 minutes, and the credential is used once and cleared after delivery.
• Ready-made Plus: one account per order, for one user; per the product description you can bind your own email. After paying, enter a delivery email and click the verification email from Cloudflare; our staff then deliver by hand and the order page shows 30 minutes to about 4 hours.
• Business seats: choose standard and premium seats (at least 2 in total). You receive the Business owner account and add or remove members yourself.
• Renewal: every subscription order covers 30 days, with reminders 7, 3 and 1 day before it ends. Renew a ready-made account by messaging Telegram @ccnb1937 with your order ID, priced like a top-up; renew a top-up by placing a new order.
• Refunds: if an OpenAI regional policy change makes the service unavailable, you get a refund for the unused days, returned in USDT within 1 business day. Bans for violating OpenAI’s usage policies are not refunded. Contact the bottom-right live chat promptly if anything goes wrong, or write to support@claudemax.shop.

Payment is USDT on TRC20 or BEP20 — handy if your card keeps getting declined (more in ChatGPT Plus or Pro when your card is declined). ClaudeMax has operated since November 2024 and has served more than 20,000 users. We are not OpenAI and not an authorised reseller; OpenAI sets the limits, features and rules, and this guide follows OpenAI’s documentation as checked on 2026-10-07.