Codexchange

Language: English | 中文

Switch local Codex accounts without running codex logout.

Codexchange saves, switches, and restores named Codex auth.json profiles. It is useful when you use multiple Codex-capable accounts and do not want to invalidate an active account just to sign in to another one.

windows/  Windows PowerShell implementation
unix/     Linux, macOS, WSL, and remote-server Python implementation

Features

• Save the current Codex login as a named profile
• Switch between saved profiles with one command
• Add another account through an isolated CODEX_HOME
• Support browser login and device auth for headless servers
• Back up the active auth.json before switching
• Show non-secret profile status information
• Provide Windows, Linux, macOS, WSL, and remote-server entrypoints

Install

Windows:

powershell -ExecutionPolicy Bypass -File .\windows\install.ps1
codex-auth-profile.cmd help

Linux, macOS, WSL, or a remote server:

sh ./unix/install.sh
export PATH="$HOME/.local/bin:$PATH"
codex-auth-profile --help

For new Unix shells, add the same PATH line to your shell profile, such as ~/.profile, ~/.bashrc, or ~/.zshrc.

The root installers remain as compatibility shims:

powershell -ExecutionPolicy Bypass -File .\install.ps1

sh ./install.sh

PowerShell Gallery support is provided by codexchange.ps1. It is useful for PowerShell-based installation and publishing, but the local platform installers above are enough for normal repository use.

Recommended Usage

Save the currently working Codex login:

codex-auth-profile.cmd save team-a

Add another account safely:

codex-auth-profile.cmd login-as team-b

On headless SSH servers, prefer device auth:

codex-auth-profile login-as team-b --device-auth

Switch accounts:

codex-auth-profile.cmd use team-a
codex-auth-profile.cmd use team-b

Check what is saved:

codex-auth-profile list
codex-auth-profile status

Why This Exists

Codex CLI, the VS Code Codex extension, and other Codex surfaces use local auth state:

Windows:     %USERPROFILE%\.codex\auth.json
Linux/macOS: ~/.codex/auth.json
Profiles:    <CODEX_HOME>/auth-profiles/<name>.auth.json

Repeatedly using codex logout to add another account can revoke the active refresh token. A saved profile may then fail later with:

Your access token could not be refreshed because your refresh token was revoked.
Please log out and sign in again.

Use login-as instead. It runs codex login in a temporary isolated CODEX_HOME, then saves that login as a named profile.

Common CLI Interface

Both platform versions expose the same actions:

list                 List saved profiles
save <name>          Save the active auth.json as a profile
use <name>           Activate a saved profile
login-as <name>      Log in under isolated CODEX_HOME and save as a profile
backup               Back up the active auth.json
status               Show non-secret auth summary and codex login status
where                Show paths used by the tool
help / --help        Show help

Windows command shape:

codex-auth-profile.cmd save team-a
codex-auth-profile.cmd login-as team-b
codex-auth-profile.cmd login-as team-b -DeviceAuth
codex-auth-profile.cmd use team-b

Linux/macOS command shape:

codex-auth-profile save team-a
codex-auth-profile login-as team-b
codex-auth-profile login-as team-b --device-auth
codex-auth-profile use team-b

After Switching

use <profile> changes the local Codex auth file immediately. Already-open Codex surfaces may keep the old account in memory. Remote servers behave the same way: the server auth.json may already be switched while VS Code Remote or another IDE still shows the previous account until it reloads.

Reload or restart the surface you are using:

VS Code local: Ctrl+Shift+P -> Developer: Reload Window
VS Code Remote / SSH server: reload or restart the IDE client window
Codex desktop app: close the app completely, then reopen it
Codex CLI/TUI: start a fresh session

If the visible account name does not change before reload, that is expected. The file has switched; the UI has not re-read it yet. Use codex-auth-profile status or compare hashes if you need to verify the active file before reloading the IDE.

Do Not Use This Flow

Avoid this:

codex-auth-profile save team-a
codex logout
codex login
codex-auth-profile save team-b

The logout step can invalidate the refresh token inside the profile you just saved. If you already did this and a profile is revoked, refresh it:

codex-auth-profile.cmd login-as team-a -Force

codex-auth-profile login-as team-a --force

Environment Interface

CODEX_HOME  Override the Codex home directory. Defaults to ~/.codex or
            %USERPROFILE%\.codex.
CODEX_EXE   Override the codex executable path when codex is not on PATH.

Examples:

$env:CODEX_EXE = "C:\path\to\codex.exe"

export CODEX_EXE=/path/to/codex

Releases

Maintainers can publish a release by pushing a version tag:

git tag v1.0.0
git push origin v1.0.0

GitHub Actions will build a cross-platform zip package automatically. The PowerShell Gallery workflow publishes codexchange.ps1 when a release is published and PSGALLERY_API_KEY is configured.

Security

Saved profiles contain real login credentials. Never commit or share:

auth.json
*.auth.json
auth-profiles/

This repository's .gitignore excludes those patterns.

Use this only for accounts you own or are authorized to use. It does not bypass OpenAI account limits, admin policy, verification, or access controls.