{"slug":"use-codex-with-aperture","title":"Use Codex with Aperture","tags":["tailscale"],"agent_summary":"Last validated: Apr 9, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Use Codex with Aperture\r\n\r\nLast validated: Apr 9, 2026\r\n\r\nAperture by Tailscaleis currently [in alpha](https://tailscale.com/docs/reference/tailscale-release-stages#alpha).\r\n\r\nConfigure [Codex](https://github.com/openai/codex) to send requests through [Aperture by Tailscale](https://tailscale.com/docs/aperture) so your organization gets centralized API key management, usage tracking, and session logging.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/aperture/how-to/use-codex\\#prerequisites)\r\n\r\nBefore you begin, you need:\r\n\r\n- An Aperture instance with at least one configured OpenAI-compatible provider, accessible from your device. Refer to [get started with Aperture](https://tailscale.com/docs/aperture/get-started) if you have not set this up.\r\n- The Aperture host URL (default: `http://ai`) accessible from your device. Use `http://`, not `https://`.\r\n- [Codex](https://github.com/openai/codex) installed on your device.\r\n\r\nTo avoid unexpected TLS issues, use `http://` for the Aperture URL when configuring LLM clients. All connections remain encrypted using WireGuard, even when HTTPS is not used.\r\n\r\nAperture routes requests based on the model name, not the LLM client. Any LLM client configured to use Aperture can access any provider your admin has set up. Refer to the [provider compatibility reference](https://tailscale.com/docs/aperture/provider-compatibility) for the full list of supported providers and API formats.\r\n\r\n## [Configure Codex](https://tailscale.com/docs/aperture/how-to/use-codex\\#configure-codex)\r\n\r\nTo configure Codex to use Aperture, create or edit the Codex configuration file (`~/.codex/config.toml`) to use the Aperture URL as the `base_url` and set the model to a Codex-compatible model:\r\n\r\n```markup\r\nmodel = \"gpt-5.2-codex\"\r\nmodel_provider = \"llm-ai-ts-net\"\r\nmodel_reasoning_effort = \"high\"\r\n\r\n[model_providers.llm-ai-ts-net]\r\nname = \"Tailscale AI Gateway\"\r\nbase_url = \"http://ai/v1\" # Required: Aperture URL\r\n\r\n# Required for gpt-5-codex models\r\nwire_api = \"responses\"\r\n```\r\n\r\nThe `wire_api = \"responses\"` setting configures Codex to use the OpenAI Responses API format. You do not need to configure an API key because Aperture injects credentials automatically.\r\n\r\n## [Verify the connection](https://tailscale.com/docs/aperture/how-to/use-codex\\#verify-the-connection)\r\n\r\n1. Send a test message in Codex.\r\n2. Open the Aperture dashboard at `http://ai/ui/` and confirm the request appears on the **Logs** page.\r\n\r\nIf the request does not appear, refer to the [Aperture troubleshooting guide](https://tailscale.com/docs/aperture/troubleshooting).\r\n\r\n## [Next steps](https://tailscale.com/docs/aperture/how-to/use-codex\\#next-steps)\r\n\r\n- [Grant model access to users](https://tailscale.com/docs/aperture/how-to/grant-model-access): Control which models each user or group can access through Aperture.\r\n- [View your usage dashboards](https://tailscale.com/docs/aperture/reference/dashboard): Monitor token consumption, costs, and session activity across your organization.\r\n- [Set per-user spending limits](https://tailscale.com/docs/aperture/how-to/set-per-user-spending-limits): Configure quota buckets to control costs for individual users.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Use Codex with Aperture

\n

Last validated: Apr 9, 2026

\n

Aperture by Tailscaleis currently in alpha.

\n

Configure Codex to send requests through Aperture by Tailscale so your organization gets centralized API key management, usage tracking, and session logging.

\n

Prerequisites

\n

Before you begin, you need:

\n\n

To avoid unexpected TLS issues, use http:// for the Aperture URL when configuring LLM clients. All connections remain encrypted using WireGuard, even when HTTPS is not used.

\n

Aperture routes requests based on the model name, not the LLM client. Any LLM client configured to use Aperture can access any provider your admin has set up. Refer to the provider compatibility reference for the full list of supported providers and API formats.

\n

Configure Codex

\n

To configure Codex to use Aperture, create or edit the Codex configuration file (~/.codex/config.toml) to use the Aperture URL as the base_url and set the model to a Codex-compatible model:

\n
model = \"gpt-5.2-codex\"\r\nmodel_provider = \"llm-ai-ts-net\"\r\nmodel_reasoning_effort = \"high\"\r\n\r\n[model_providers.llm-ai-ts-net]\r\nname = \"Tailscale AI Gateway\"\r\nbase_url = \"http://ai/v1\" # Required: Aperture URL\r\n\r\n# Required for gpt-5-codex models\r\nwire_api = \"responses\"\n
\n

The wire_api = \"responses\" setting configures Codex to use the OpenAI Responses API format. You do not need to configure an API key because Aperture injects credentials automatically.

\n

Verify the connection

\n
    \n
  1. Send a test message in Codex.
    2. \n
  2. Open the Aperture dashboard at http://ai/ui/ and confirm the request appears on the Logs page.
    3. \n
\n

If the request does not appear, refer to the Aperture troubleshooting guide.

\n

Next steps

\n\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}