codex-switch-secure

A security-focused multi-account manager for OpenAI Codex CLI, with CLI/TUI quota routing and a localhost-only web dashboard.

This repository tracks xjoker/codex-switch and adds a browser UI, guided configuration, local usage views, explicit endpoint-override gates, and conservative credential/update handling.

codex-switch manages local authentication files. Never publish profiles, auth.json, tokens, proxy credentials, Share Auth installers, or unredacted debug output.

Web dashboard

The dashboard provides:

• Codex account cards with live 5h/weekly quota and reset timing,
• device-code sign-in and re-authentication,
• account naming, plan notes, ordering, removal, and routing status,
• local Codex token/thread exploration,
• optional Anthropic and xAI key validation panels,
• optional shared-machine telemetry through a Google Sheet CSV,
• trusted-machine Share Auth helpers with explicit secret warnings, and
• a safe editor for ~/.codex-switch/config.toml.

The configuration editor covers cache, concurrency, TUI refresh, weekly safety margin, Team priority, daemon behavior, launch timing, and proxy/no-proxy settings. It preserves unknown TOML keys/comments, validates before writing, uses private files plus a rolling backup, rejects symlink targets, and never returns stored proxy credentials to the browser.

The server binds to 127.0.0.1 only and validates localhost Host/Origin headers. Do not expose it through a LAN bind, tunnel, reverse proxy, or public host.

Install

The fork intentionally builds from reviewed source instead of downloading an unrelated upstream binary. Requirements:

• Rust/cargo 1.88+
• Python 3.11+ for the web UI
• Git plus curl/tar on macOS/Linux, or PowerShell on Windows

macOS / Linux / WSL

curl -fsSL https://raw.githubusercontent.com/five0nit/codex-switch-secure/master/scripts/install.sh | bash

Windows PowerShell

irm https://raw.githubusercontent.com/five0nit/codex-switch-secure/master/scripts/install.ps1 | iex

The installers run the Rust build and the local-web test suite before installing:

• CLI/TUI: codex-switch
• web dashboard: codex-switch-web

Then open:

http://127.0.0.1:8787/

From an existing checkout

git clone https://github.com/five0nit/codex-switch-secure.git
cd codex-switch-secure
cargo build --release --locked
python3 -Wall -m py_compile local-web/server.py local-web/test_server.py
python3 -m unittest -v local-web/test_server.py
CODEX_SWITCH_BIN="$PWD/target/release/codex-switch" python3 local-web/server.py

Quick start

Codex must use its file credential store. If needed, add this to $CODEX_HOME/config.toml (normally ~/.codex/config.toml):

cli_auth_credentials_store = "file"

A managed configuration with forced_login_method = "api" is incompatible because this tool routes ChatGPT/Codex OAuth profiles.

codex-switch setup
codex-switch login --device work-pro
codex-switch list --force
codex-switch use
codex-switch launch
codex-switch tui
codex-switch-web

What the current core does

• Saves, imports, renames, switches, and recoverably deletes Codex profiles.
• Displays main and model-specific quota pools in CLI and TUI views.
• Selects an eligible account with adaptive, pace-aware scoring.
• Launches Codex with a selected or best eligible account.
• Supports reset cards, quota warmup, JSON output, proxies, and a Beta background daemon on macOS, Linux, and Windows.
• Refreshes expiring tokens and preserves rotated credentials through atomic private writes.

This fork incorporates upstream through 20260804.1.0 plus its subsequent security, Windows, distribution, and warmup fixes at upstream commit a3392f6 before applying the fork-specific web/security layer.

Security differences in this fork

• Runtime endpoint overrides such as CS_TOKEN_URL and CS_USAGE_URL are ignored unless CS_ALLOW_INSECURE_ENDPOINT_OVERRIDES=1 is explicitly set. This prevents a poisoned shell environment from redirecting OAuth/bearer traffic.
• Runtime self-update and release publication remain disabled. Re-run the reviewed source installer to update.
• The dashboard never displays OAuth tokens and redacts stored proxy credentials.
• Share Auth payloads are intentionally sensitive. Use them only on machines/users you trust; never paste them into GitHub, Telegram, Discord, CI logs, tickets, or screenshots.
• Long-running Hermes/OpenClaw processes are never restarted automatically after an auth sync.

See SECURITY.md and the local web guide.

Configuration

The browser editor is the easiest path. The same settings remain available in ~/.codex-switch/config.toml; see docs/wiki/Configuration.md.

Updating

Re-run the source installer. It preserves ~/.codex-switch/ account/config data and rebuilds/tests before replacing the installed binary and web server.

curl -fsSL https://raw.githubusercontent.com/five0nit/codex-switch-secure/master/scripts/install.sh | bash

codex-switch self-update is deliberately disabled in this fork.

Development

cargo fmt --check
cargo test --all
cargo clippy --all-targets -- -D warnings
python3 -Wall -m py_compile local-web/server.py local-web/test_server.py
python3 -m unittest -v local-web/test_server.py
bash -n scripts/install.sh

Documentation sources: docs/wiki/ · release notes · contributing.

License and upstream

MIT licensed. Original project: xjoker/codex-switch. Fork-specific changes are maintained at five0nit/codex-switch-secure.