Codex download: every install route in one place

Pick the surface first

The CLI, five ways

The official installer (recommended)

curl -fsSL https://chatgpt.com/codex/install.sh | sh

codex --version

powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

npm

npm install -g @openai/codex

# update
npm install -g @openai/codex@latest

The npm route needs Node 18 or newer, and it inherits the classic global-npm failure: upgrade Node and the command disappears, because the global prefix moved. If that happens, reinstall or switch to the standalone installer.

Homebrew

brew install --cask codex

# update
brew upgrade --cask codex

# where it went
which codex     # $HOMEBREW_PREFIX/bin/codex

A release binary

Right choice for a locked-down machine, a container image, or any environment where piping a script into a shell is not allowed.

V=rust-v0.147.0
A=codex-aarch64-apple-darwin

curl -fsSLO "https://github.com/openai/codex/releases/download/$V/$A.tar.gz"
tar -xzf "$A.tar.gz"
mv "$A" ~/.local/bin/codex
chmod +x ~/.local/bin/codex

codex --version

DotSlash, for pinning a team

Every release also carries a DotSlash file simply named codex. Commit it and every contributor runs the identical version on whatever platform they use, without anyone installing anything. This is the cleanest answer to "our CI and our laptops are on different Codex versions".

Which route to actually pick

They all end at the same binary, so this is a maintenance decision rather than a capability one. The differences show up months later, when something upgrades underneath you.

The npm row is the one worth taking seriously. A global npm install lives under whichever Node version prefix was active when you ran it, so a later Node upgrade makes the command vanish with no error, no missing file and no obvious cause. If you have already been bitten by that with another CLI, take the standalone installer and stop thinking about it.

In a Dockerfile, prefer the release archive over any script. It pins a version, adds no package manager to the image, and does not depend on a network host staying reachable at build time. Extract the archive, rename the single file inside it to codex, and put it on PATH.

One thing no route gives you is a signed guarantee across every platform. The Linux musl archives ship with matching .sigstore bundles on each release; the macOS and Windows assets do not carry one in the same form. If your policy requires provenance verification, that asymmetry is worth checking before you standardise on a route rather than after.

Where the installers actually fetch from

Worth knowing before you debug a corporate proxy. The standalone installers download from https://releases.openai.com/codex by default and fall back to GitHub Releases when metadata or an asset is unavailable. You can force the GitHub path:

curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false sh

$env:CODEX_INSTALLER_USE_RELEASES_OPENAI_COM='false'; irm https://chatgpt.com/codex/install.ps1 | iex

Requirements, and what to check after

codex --version
codex doctor            # diagnostic report

codex login             # browser flow, uses your ChatGPT plan
codex login status      # confirm which account is active

echo $OPENAI_API_KEY    # should be EMPTY for subscription billing

That last line matters more than it looks. A stray OPENAI_API_KEY exported months ago for an unrelated script takes precedence over the subscription login, and you will pay per token while holding a plan that already covers it.

Updating and removing

Nothing above touches ~/.codex, so your config, credentials and transcripts survive a reinstall. The one exception is Homebrew's --zap, which deletes that directory on purpose.

Questions people ask

Keep reading