Create a Dedicated Codex Auth File

TL;DR

Create a fresh Codex login dedicated to Zozo, then upload its auth.json on the Credentials page. The commands below leave your default local login unchanged and give Zozo its own session to refresh.

A Codex subscription Credential contains the login session Zozo uses to run Codex. You can sign in with your usual OpenAI account while creating a separate session for Zozo.

Give Zozo its own login session

If you upload an auth file that you also actively use locally, either copy can rotate the refresh token and leave the other with a consumed token. Later work can fail with “Your refresh token was already used.” Create a fresh login for Zozo and let Zozo exclusively use that session after upload.

Create the File

With the Codex CLI installed, paste this block into a Bash or Zsh terminal on macOS or Linux:

(
  set -eu
  umask 077
  zozo_auth_dir="$(mktemp -d "$HOME/.codex-zozo-login.XXXXXX")"

  env CODEX_HOME="$zozo_auth_dir" \
    codex -c 'cli_auth_credentials_store="file"' login

  test -s "$zozo_auth_dir/auth.json"
  chmod 600 "$zozo_auth_dir/auth.json"
  printf '\nUpload this file to Zozo:\n%s\n' "$zozo_auth_dir/auth.json"
)

Complete the browser login with the account you want Zozo to use. After a successful login, the terminal prints the exact path to the new auth.json. Each execution creates a fresh directory, so a later replacement gets a new login session.

CODEX_HOME applies only to that login command. Explicit file storage keeps the new session in that directory instead of the default OS credential store. Your usual codex command and local sessions continue using their existing login; there's nothing to switch back. These settings are described in OpenAI's credential storage documentation.

If a browser login isn't available, add --device-auth after login in the command above and follow the displayed instructions. Device login must be enabled in your account or workspace settings; see OpenAI's headless login instructions.

Upload to Zozo

1. Open Credentials in your Zozo dashboard, or use the credential step in Setup.
2. In Add a Credential, enter a name, choose Codex as the Provider (the coding runtime), and choose Subscription (auth.json).
3. Select the file at the path printed by the command. On macOS, press Command + Shift + G in the file chooser to enter the path to the hidden directory.
4. Read and accept the subscription disclosure, then click Add Credential.

When replacing a broken Credential, enter its existing name to update it in place. Once validation succeeds, resume the failed Thread (the conversation containing the failed work). See Connect a Personal Subscription Credential for model and effort settings.

Keep the Sessions Separate

Zozo refreshes the uploaded session as it runs. Your original local copy of that dedicated file can become stale after upload.

Keep the uploaded session exclusive to Zozo

Don't run local Codex with the dedicated directory, sync its original file back over Zozo's refreshed Credential, or upload that same session to another independently running installation. For a replacement or another installation, create another fresh login using the commands above.

After upload and validation succeed, you can delete the dedicated local directory. Deleting those local files doesn't sign Zozo out; avoid logging out of the transferred session as a cleanup step. Keep auth.json out of repositories, messages, and screenshots because it contains secrets.

If you already see a refresh-token reuse error, create a fresh session and replace the affected Credential under its existing name. Retrying the consumed token won't repair it.