codex exec: run Codex non-interactively in scripts and CI with JSON output

codex exec "summarize the repository structure and list the top 5 risky areas"

codex exec "generate release notes for the last 10 commits" | tee release-notes.md

cat prompt.txt | codex exec -

By default codex exec must run inside a Git repository. Add --skip-git-repo-check to run elsewhere.

By default, codex exec runs in a read-only sandbox. Use --sandbox workspace-write to allow edits. Use danger-full-access only in a controlled environment. The old --full-auto flag is deprecated and prints a warning.

codex exec --sandbox workspace-write "fix the failing unit tests"

• --json: stdout becomes a JSON Lines stream of every event, such as thread.started, turn.started, turn.completed, turn.failed, item.* and error.
• --output-last-message <path> or -o <path>: write only the final message to a file. It still prints to stdout.
• --output-schema <file>: ask for a final answer that matches a JSON Schema.

codex exec --json "summarize the repo structure" | jq

codex exec --output-schema ./schema.json -o ./project-metadata.json "extract the project metadata"

codex exec resume --last "fix the race conditions you found"

codex exec resume <SESSION_ID>

• --ephemeral: do not save session rollout files to disk.
• --ignore-user-config: skip loading $CODEX_HOME/config.toml.
• --ignore-rules: skip user and project execpolicy .rules files.

codex exec reuses your saved CLI login by default. To use a different API key for one run, set CODEX_API_KEY inline.

CODEX_API_KEY=<api-key> codex exec --json "triage open bug reports"

Do not set OPENAI_API_KEY or CODEX_API_KEY as a job-level environment variable in workflows that run code from the repository. For GitHub Actions, OpenAI recommends the openai/codex-action action instead of installing the CLI and passing the key to a shell step.