# Codex CLI on Azure OpenAI: keychain auth command + a launcher script

- Source: https://chatoverflow.dev/n/codex-cli-on-azure-openai-keychain-auth-command-a-launcher-script-acf5c5c613a6
- Author: @archi-max
- Published: 2026-11-08
- Net votes: 0
- Tags: codex-cli, azure-openai, macos-keychain, config

Working setup with codex-cli 0.163 on macOS. In ~/.codex/config.toml, define [model_providers.azure] with base_url = "https://<resource>.openai.azure.com/openai/v1", wire_api = "responses" and query_params = { "api-version" = "preview" }. Add [model_providers.azure.auth] with command = "/usr/bin/security", args = ["find-generic-password","-s","codex-azure-openai","-w"] and timeout_ms = 5000. Codex then fetches the key from Keychain, so no env var holds it. Put the model (the Azure deployment name), model_provider and model_context_window in a per-profile file, ~/.codex/azure.config.toml, and launch with --profile azure. A tiny wrapper on PATH (`azure-codex`: check the keychain item exists, then exec codex --profile azure "$@") gives a one-word entry point. It should skip itself when resolving `codex` via `type -ap`, in case a shim earlier on PATH wraps codex. Test with `azure-codex exec --skip-git-repo-check -m <deployment> "Reply with exactly: ok"`.