Codex Cloud runs Codex coding tasks in the cloud instead of on your own computer, so the work keeps going while your laptop is asleep, and you start and review tasks from ChatGPT on the web, on mobile or in the desktop app. You set up a reusable cloud environment once, with your repositories, tools and access settings, and every new task starts from its own isolated copy of it.
That one idea, the environment, is what this page is about. If you've never used Codex, start with my beginner walkthrough and come back. This is the reference for what happens after that: setup, secrets, internet access, sharing, and the part that's being retired.
Environments, in plain words
A cloud environment is the reusable setup your tasks use: repositories, dependencies, tools and access settings. Codex inspects your repositories, prepares the setup and tests it with you. You can start tasks on the web, on mobile or in the desktop app, but new environments are created on the web or in the desktop app only, as of October 2026.
Four words in the settings do different jobs, and mixing them up is how people end up wondering why a change didn't stick:
| Setting | What it does |
|---|---|
| Save | Stores the configuration. Some settings apply to the active setup straight away. |
| Publish | Captures the prepared filesystem that every new task starts from. |
| Republish | Updates that captured setup after an edit. Only new tasks pick it up. |
| Who can use | Controls who can start tasks from the environment: only you, or your workspace. |
A new task starts from the published filesystem. An existing task carries on with its own saved files, including uncommitted changes and installed tools, and repository refreshes run in the background without rerunning installation. To change the setup, go to Settings, Codex Cloud, Environments, open the environment's menu, choose Edit, describe the change, let Codex test it, save and Republish. The docs add one line I'd underline: saved state doesn't replace source control. Commit what matters.
Setting up your first environment
OpenAI's overview gets you from nothing to a running task in five steps:
- Open ChatGPT on the web, on mobile or in the desktop app, and sign in with your ChatGPT account.
- On the web or desktop, choose Work in, then Cloud, and open Select environment. Pick an existing one, or choose Create environment.
- Choose your GitHub repositories and select Get started, connecting GitHub if asked. Codex inspects the repositories, installs dependencies and tools, and tests the workflow. Give it any access or details it asks for.
- Review the setup and test results, save your changes and select Publish. Wait for the Environment published message.
- Select Start a new task and describe what you want. Review the changes and test results, ask for follow-ups, then commit or open a pull request when you're happy.
You don't need to write an installation script yourself. Codex can record the tested setup in two fields: an Install script, the commands that install dependencies and prepare assets, and a Start skill, the instructions to start services and check they're ready. You can still ask for specific versions, commands or services during the setup conversation.
Secrets and internet access
Codex asks for any configuration it can't work out for itself, and you choose how to hand each value over. An environment variable goes straight to the programs that need it. A network secret is a credential meant for one specific HTTPS service: programs only ever see a stand-in value, and the proxy swaps in the real credential when the request goes to an allowed domain over HTTPS on port 443. The raw credential never sits in a local file or process, which makes it the safer choice for API tokens.
Shared environments can ask each person to supply their own values through the Personal vault, under Settings, Codex Cloud. Sharing an environment shares the requirement, not your credentials, and only requested values reach a task.
For internet access, you either switch on Enable all public internet access, or leave it off and allow only what the project needs. The Package managers preset covers registries such as npm, PyPI, crates.io and Go, plus Ubuntu and Debian repositories and GitHub, and you add anything else under Additional allowed domains. The docs make the point that allowing a destination doesn't supply credentials or grant permissions in that service.
VPNs and cloud accounts
For services on a private network, Tailscale is the supported VPN provider as of October 2026. When you create the Tailscale auth key, enable both Reusable and Ephemeral, so new task machines can join your network and drop off cleanly when they go offline. Databases and other TCP services go through the environment's HTTP CONNECT proxy, and only IPv4 addresses routed through Tailscale work. Public internet settings and VPN access are independent: restricting one doesn't switch off the other.
For cloud resources, OpenID Connect lets a task get short-lived credentials from your cloud provider. Your organisation sets up the trust and decides the permissions, and your own personal permissions don't transfer. That's a job for whoever runs your cloud account, not the person writing the task.
Sharing it with your team
In an Enterprise workspace, open the environment's configuration and, under Privacy, Who can use, choose your workspace, then save and publish. Choose Only me to keep it private. Each task has its own working files, so access to the setup doesn't give anyone access to a colleague's task or the right to edit the environment. Two admin permissions control this: Use Codex in the cloud for running tasks, and Manage workspace environments for creating and editing shared ones. Review the prepared files and any environment-owned credentials before you share.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Developers can also start a cloud task from the Codex CLI, list recent cloud chats and check their status without opening a browser.
The legacy version is on its way out
Here's the catch to plan around. OpenAI's environments page says Codex Cloud (Legacy) still supports Code Review and the Linear and GitHub integrations, and then says plainly: "We plan to deprecate this experience." If your team relies on Code Review or those Linear and GitHub integrations, check which experience they run on before you build more around them. Admins creating environments for those workflows are pointed to a separate legacy guide.
Who should skip Codex Cloud? Anyone without a GitHub repository. Setup starts by picking repositories, so a non-coder gets very little from it directly. If you're weighing tools, I've laid out how Chat, Work and Codex differ and how Codex compares with Claude Code.
My advice: I'd start with one repository, with full public internet access switched off and only the Package managers preset allowed, and skip VPN and OIDC until the first task works end to end.
If you're deciding which of your team's coding tasks can safely run in the cloud while everyone's offline, that's the kind of AI enablement I help with. I run AI training and workshops for teams, and help businesses with AI enablement and workflow automation, so the busywork runs itself and people get time back. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
What is Codex Cloud?
It's the way to run Codex coding tasks in the cloud from ChatGPT on the web, mobile or desktop, so work continues while your computer is asleep. Tasks start from a saved, published environment.
What's a Codex cloud environment?
It's the reusable setup tasks use: repositories, dependencies, tools and access settings. Each new task gets its own isolated workspace from the published environment.
Do I need to write an install script for Codex Cloud?
No. Codex inspects your repositories and can record the tested setup as an Install script and a Start skill for you.
Can Codex Cloud tasks reach the internet?
Only as far as you allow. Turn on Enable all public internet access, or keep it off and allow the Package managers preset plus specific domains.
Is Codex Cloud being discontinued?
OpenAI says it plans to deprecate the Codex Cloud (Legacy) experience, which still supports Code Review and the Linear and GitHub integrations.
