What you’ll need
- The Codex CLI installed.
- An access key from app.ngrok.ai.
Add the gateway as a model provider
Export your access key in your shell profile, such as~/.zshrc or ~/.bashrc, so Codex can read it:
~/.codex/config.toml:
- Defines a provider named
ngrokthat points at the gateway - Reads your access key from
NGROK_AI_GATEWAY_KEYand sends it as anAuthorization: Bearerheader - Uses the Responses API, the only wire protocol current Codex versions support
- Makes
ngrokthe default provider, withgpt-5.5as the default model - Loads model details from the catalog you saved
~/.codex/config.toml.
Codex ignores model_provider and model_providers in a project’s .codex/config.toml.
The provider ID can’t be openai, ollama, or lmstudio, which Codex reserves for its built-in providers.
Test the connection
Send a single prompt from the command line:provider: ngrok and your model.
Confirm the request in AI Gateway observability in app.ngrok.ai.
Choose a model
Pass--model (or -m) to start a session on a different model:
provider:model name such as openai:gpt-5.5 reaches the gateway, but Codex doesn’t find it in the catalog and falls back to generic defaults.
Keep OpenAI as your default
To keep Codex on your OpenAI login by default and use the gateway only when you ask for it, put the gateway settings in a profile instead ofconfig.toml.
Create ~/.codex/ngrok.config.toml:
config.toml first, then layers the profile on top, so sessions without --profile ngrok stay on OpenAI.
Troubleshooting
For gateway-side errors, see Debug failed requests.
Next steps
- Restrict providers and models: Scope what an access key can call
- Configure fallback models: Try another model when the first one fails
- Observability: See which model served each request