config-key 110 plugins.<plugin>.enabled — Enable or disable a local-marketplace plugin using a `plugin-name@marketplace-name` key. Read from the effective merged config; trusted-project settings can override user, cloud-managed, and system defaults. Marketplace refresh can install or refresh configured plugins even when disabled. This does not override workspace-managed enabled states. marketplaces.<name>.sparse_paths — Optional sparse checkout paths for a Git marketplace. Include the marketplace catalog and any local plugin directories it references. marketplaces.<name>.ref — Optional Git branch, tag, or commit for the marketplace. marketplaces.<name>.source — Git repository location or local marketplace root directory. Use an absolute path for a local source; the directory contains .agents/plugins/marketplace.json. marketplaces.<name>.source_type — Source kind for a configured plugin marketplace. Marketplaces can be defined in system, cloud-managed, user, or trusted-project config.toml. allowed_chatgpt_workspaces — Restrict ChatGPT login, including Codex access tokens, to the listed workspace IDs. An empty list disables ChatGPT login; API authentication remains available when permitted. Set through the local system requirements file or macOS MDM; cloud-managed values are ignored. allowed_login_methods — Allow `chatgpt`, `api`, or both. If omitted, this setting doesn't restrict login methods. If set, the list must contain at least one method. `api` permits API authentication, including Amazon Bedrock. Set through the local system requirements file or macOS MDM. Cloud-managed values are ignored. browser_use.origins — Origin-specific Browser Use policies. Keys use `<scheme>://<host-pattern>[:<port>]` with `http` or `https`. Use an exact host, `*.example.com` for subdomains only, or `**.example.com` for the base domain and its subdomains. Other `*` wildcards can span dots, so `region*.example.com` also matches `region.api.example.com`; a host of `*` matches every host for that scheme. Schemes and nondefault ports are significant; explicit default ports are normalized away. Paths, queries, embedded usernames or passwords, and wildcard schemes or ports are invalid. Quote the pattern in TOML, for example `[browser_use.origins."https://**.example.com"]`. computer_use.windows.exes[].access — Required access decision for matching executables. `deny` blocks access. `allow` overrides only this policy source's default and still requires any other policy source and the normal approval flow to allow the app. computer_use.windows.exes[].binary_name — Optional `OriginalFilename` from the executable's signed version information. Matching is case-insensitive. If a matching publisher and product rule requires this value but the executable does not provide it, Computer Use blocks the executable. computer_use.windows.exes[].product_name — Required exact `ProductName` from the executable's signed version information. computer_use.windows.exes[].publisher_name — Required exact publisher name from the executable's trusted signing certificate, formatted as a Windows X.500 distinguished name. computer_use.windows.aumids.<aumid> — Use `deny` to block the exact packaged-app identity. `allow` overrides only this policy source's default and still requires any other policy source and the normal approval flow to allow the app. computer_use.windows — Computer Use app rules for packaged and unpackaged Windows apps. computer_use.macos.bundle_ids.<bundle-id> — Use `deny` to block the exact bundle identifier. `allow` overrides only this policy source's default and still requires any other policy source and the normal approval flow to allow the app. computer_use.macos — Computer Use app rules for macOS. browser_use.default_origin_policy.access_approval_lifetime — Set how long a non-persistent site-access approval lasts: `turn` limits it to the current turn, and `thread` keeps it for the rest of the current thread. `persistent_approval` separately controls whether `Always allow` is available. The product default is `thread`. computer_use.allow_persistent_approval — Set to `false` to remove the option to save app approvals across sessions. Approvals for the current session remain available. Setting it to `true` or omitting it does not approve an app. browser_use.origins.<pattern>.access_approval_lifetime — Set how long a non-persistent site-access approval for matching origins lasts: `turn` limits it to the current turn, and `thread` keeps it for the rest of the current thread. `persistent_approval` separately controls whether `Always allow` is available. browser_use.origins.<pattern>.persistent_approval — Set to `false` to prevent Browser Use from saving or honoring an `Always allow` approval on matching origins. Approvals for the current turn or thread can still apply. `true` makes `Always allow` available when otherwise permitted but does not create an approval. browser_use.origins.<pattern>.auto_review — Use `deny` to skip automatic review on matching origins and ask the user for approval instead. `allow` leaves automatic review available when other settings allow it. browser_use.origins.<pattern> — Policy for origins matching this pattern. If several patterns match, Codex uses the most restrictive value for each capability: `deny` over `allow`, `false` over `true`, and `turn` over `thread`. browser_use.allow_global_persistent_approval — Set to `false` to prevent Browser Use from creating or honoring `Always allow` approvals that cover every site, such as allowing downloads from any site. Existing saved approvals are ignored, not deleted. Setting it to `true` or omitting it does not create an approval. browser_use.default_origin_policy.persistent_approval — Set to `false` to prevent Browser Use from saving or honoring an `Always allow` approval on origins that use the fallback. Approvals for the current turn or thread can still apply. `true` makes `Always allow` available when otherwise permitted but does not create an approval. browser_use.default_origin_policy.auto_review — Use `deny` to skip automatic review on origins that use the fallback and ask the user for approval instead. `allow` leaves automatic review available when other settings allow it. browser_use.default_origin_policy.full_cdp_access — Use `deny` to block full Chrome DevTools Protocol (CDP) access on origins that use the fallback. `allow` only lets normal opt-in and approval checks continue. browser_use.default_origin_policy.uploads — Use `deny` to block Browser Use uploads on origins that use the fallback. `allow` only lets normal approval and policy checks continue. browser_use.default_origin_policy.downloads — Use `deny` to block Browser Use downloads on origins that use the fallback. `allow` only lets normal approval and policy checks continue. browser_use.default_origin_policy.access — Use `deny` to block Browser Use on origins that use the fallback. A denied origin also blocks uploads, downloads, full browser debugging access, and automatic review there. `allow` only lets normal approval and policy checks continue. browser_use.disable_auto_review — Set to `true` to skip automatic review for Browser Use and ask the user for approval instead. Setting it to `false` or omitting it leaves automatic review available when other settings allow it. browser_use — Managed requirements for agent-driven Browser Use. in_app_browser.allow_external_browser_settings_import — Set to `false` to prevent users from importing settings or browsing data from an external browser into the built-in browser. Setting it to `true` or omitting it leaves the import available when other product checks allow it. This is a managed-only setting with no `config.toml` override. features.context_management.experimental_mode — Enable experimental context management (off by default). Rather than repeatedly compressing context into a single summary, it uses notes and searchable history to preserve accumulated details. Requires ChatGPT sign-in on Plus, Pro, or Pro Lite. browser_use.origins.<pattern>.full_cdp_access — Use `deny` to block full Chrome DevTools Protocol (CDP) access on matching origins. `allow` only lets normal opt-in and approval checks continue. browser_use.origins.<pattern>.uploads — Use `deny` to block Browser Use uploads on matching origins. `allow` only lets normal approval and policy checks continue. browser_use.origins.<pattern>.downloads — Use `deny` to block Browser Use downloads on matching origins. `allow` only lets normal approval and policy checks continue. browser_use.origins.<pattern>.access — Use `deny` to block Browser Use on matching origins. Denial also blocks uploads, downloads, full browser debugging access, and automatic review there. `allow` only lets normal approval and policy checks continue. in_app_browser — Requirements for the built-in browser pane. These settings do not control agent-driven Browser Use. allow_browser_and_computer_use — Set to `false` to block both agent-driven Browser Use and native-app Computer Use. Setting it to `true` or omitting it does not enable either feature; the remaining feature, policy, and approval checks still apply. computer_use.windows.exes — Windows executable access rules. Each rule requires `publisher_name`, `product_name`, and `access` (`allow` or `deny`); `binary_name` is optional. computer_use.windows.aumids — Packaged Windows app access keyed by Application User Model ID (AUMID). computer_use.macos.bundle_ids — Native macOS app access keyed by bundle identifier. browser_use.origins.<origin> — Per-origin browser restrictions with the same fields as `browser_use.default_origin_policy`. Include an HTTP or HTTPS scheme and optional port; omit paths, queries, and fragments. Local values cannot relax managed denies. computer_use.default_app_access — Fallback native-app access policy for Computer Use. App-specific entries can supply a policy; local configuration cannot relax managed restrictions. browser_use.default_origin_policy — Fallback browser-origin restrictions. Supports `access`, `uploads`, `downloads`, and `full_cdp_access`, each set to `allow` or `deny`. browser_use.allow_history_access — Set to `false` to restrict browser-history access. Managed requirements can enforce this restriction. mcp_servers.<id>.http_headers_helper — Local command that prints a JSON object of HTTP header names and values. Supported only for locally connected HTTP MCP servers. Explicit bearer tokens and OAuth credentials take precedence over helper-provided Authorization headers. mcp_servers.<id>.tools.<tool>.output_token_limit — Token budget for one MCP tool's output, before the standard 20% serialization allowance. Overrides the model's default output truncation budget for that tool. mcp_optional_startup_grace_ms — Shared wait for optional MCP servers when building the initial tool catalog. Defaults to `1000`. Set to `0` to wait for each server's `startup_timeout_sec` instead. skills.max_context_tokens — Token budget for the available-skills catalog. Defaults to 2% of the model's context window. Explicit values are capped at `10000` tokens. mcp_servers.<id>.oauth.callback_url — Server-specific OAuth callback. Pre-registered clients reuse it when issuer identification is supported or the URL already ends in the server-specific callback ID. Otherwise, Codex uses the global or default callback with that ID appended. Clients without a pre-registered ID use this callback during client registration. mcp_servers.<id>.oauth.callback_port — Fixed OAuth callback listener port for this MCP server. Overrides `mcp_oauth_callback_port`. For a direct loopback callback with an explicit URL port, configure the same listener port. mcp_servers.<id>.oauth.client_id — Pre-registered OAuth client ID used for authorization and token exchange with this MCP server. features.in_app_updates — Set to `false` in `requirements.toml` to disable in-app updates. Updates remain enabled by default when this requirement is omitted. models.new_thread.service_tier — Default service tier for new threads. An explicit service-tier override causes this field to be ignored. models.new_thread.model_reasoning_effort — Default reasoning effort for new threads. An explicit override of either the model or reasoning effort causes both fields to be ignored. models.new_thread.model — Default model for new threads. An explicit override of either the model or reasoning effort causes both fields to be ignored. models.new_thread — Optional defaults to apply when a new local thread starts. They take priority over user and project defaults, but can be superseded by explicit overrides. models — Contains the `[models.new_thread]` table. hooks.<Event>[].hooks[].additionalContextLimit — Approximate per-handler token threshold for saving oversized `additionalContext` to disk and showing the model a shorter preview. Defaults to `2500`; `0` passes the full context directly to the model. See [Large hook output](/codex/hooks#large-hook-output). features.remote_plugin — Enable the remote plugin catalog (stable; on by default). agents.interrupt_message — Record a model-visible message when an agent turn is interrupted (default: true). agents.max_concurrent_threads_per_session — Maximum number of spawned-agent threads that can be open concurrently, excluding the primary thread. When unset, Codex chooses the default. agents.enabled — Enable or disable multi-agent tools (default: true). mcp_servers.<id>.auth — Authentication fallback for an MCP HTTP server after configured bearer tokens and authorization headers. `oauth` (default) uses stored MCP OAuth credentials when available. `chatgpt` uses the current ChatGPT session for the trusted first-party ChatGPT origin, then falls back to stored OAuth. Both modes can connect without authentication if no credential source resolves. desktop.custom_file_handlers.<id>.args — Arguments inserted between the command and file input (default: `[]`). agents.default_subagent_model — Default model for spawned agents. An explicit spawn model takes precedence. computer_use.windows.always_allowed_app_ids — Windows app identifiers that Computer Use can open without prompting. Apps not in the list require approval; remove saved entries from the ChatGPT desktop app's Computer Use settings. tui.resume_cwd — Working directory to use when resuming or forking a session. When unset, Codex asks you to choose if your current directory differs from the session's saved directory. desktop.custom_file_handlers.<id>.supports_ssh — Offer the handler for files in SSH workspaces (default: `false`). desktop.custom_file_handlers.<id>.input — How the app sends file input to the handler (default: `path`). desktop.custom_file_handlers.<id>.icon — Bundled asset path, Base64-encoded `data:image/...` URL, file URI, or absolute local path for the handler icon. Required; unsupported sources use the default VS Code icon. desktop.custom_file_handlers.<id> — User-level only. Defines an additional **Open in** target for the ChatGPT desktop app. See [Add custom file handlers](/codex/config-file/config-advanced#add-custom-file-handlers) for examples and handler ID constraints. model_providers.<id>.supports_standalone_web_search — Advertise support for a compatible standalone web search endpoint (default: false). Standalone search remains under development and off by default; provider compatibility alone doesn't enable it. desktop.custom_file_handlers.<id>.label — Display name shown in **Open in** menus. Required. agents — Multi-agent settings and custom role declarations. Scalar setting names are reserved and can't be used as custom role names. model_auto_compact_token_limit_scope — Controls whether the auto-compaction threshold counts the full active context (`total`, the default) or only growth after the carried compaction-window prefix (`body_after_prefix`). features.goals — Enable persisted goals and automatic continuation (stable; on by default). agents.default_subagent_reasoning_effort — Default reasoning effort for spawned agents. An explicit spawn effort takes precedence. shell_environment_policy.filters — Canonical case-insensitive environment-variable pattern filters. Include entries create an allowlist and can't restore excluded values. Explicit `set` values apply after exclusions. Don't combine filters with legacy `exclude` or `include_only` arrays in the same layer. feedback — Managed feedback settings. desktop.custom_file_handlers.<id>.command — Executable path or command name to detect and launch. Required. hooks.<Event>[].hooks[].async — Run a command hook in the background without delaying the triggering operation. Defaults to `false`; `SessionEnd` always runs synchronously. See [Run hooks in the background](/codex/hooks#run-hooks-in-the-background). marketplaces.allowed_sources.<name>.path — Local marketplace directory required when `source = "local"`. Codex requires an absolute path and compares paths after normalization. plugins.<plugin>.mcp_servers.<server>.identity.url.value — Value used by an `exact` or `prefix` URL matcher. plugins.<plugin>.mcp_servers.<server>.identity.url.match — Match operation for the plugin-bundled MCP server URL. mcp_servers.<id>.identity.command.args[].expression — Regular expression used by a `regex` argument matcher. The expression must be valid and match the complete argument value. mcp_servers.<id>.identity.command.args[].value — Value used by an `exact` or `prefix` argument matcher. marketplaces.allowed_sources.<name>.host_pattern — Regular expression required when `source = "host_pattern"`. Codex matches it against the lowercase hostname parsed from an HTTPS, SSH, or SCP-style Git source. Use `^` and `$` to require a whole-host match. marketplaces.allowed_sources.<name>.ref — Optional exact Git ref for a `git` rule. When omitted, the rule allows any ref for the matching repository. marketplaces.allowed_sources.<name>.url — Git repository URL required when `source = "git"`. Codex normalizes the configured and allowed URLs before requiring an exact repository match. marketplaces.restrict_to_allowed_sources — When `true`, require configured marketplace sources to match `allowed_sources` for marketplace add, plugin install, refresh, and runtime loading. OpenAI-curated Git catalogs, including the API-key catalog, must also match the allowlist. Bundled and remotely installed workspace plugins are separate from this curated Git source policy. marketplaces — Admin requirements for plugin marketplace sources. Rules take effect when `restrict_to_allowed_sources` is `true`. plugins.<plugin>.mcp_servers.<server>.identity.url.expression — Regular expression used by a `regex` URL matcher. The expression must match the complete URL value. plugins.<plugin>.mcp_servers.<server>.identity.command.args[].expression — Regular expression used by a `regex` argument matcher. The expression must match the complete argument value. plugins.<plugin>.mcp_servers.<server>.identity.command.args[].value — Value used by an `exact` or `prefix` argument matcher. plugins.<plugin>.mcp_servers.<server>.identity.command.args[].match — Match operation for this argument position. plugins.<plugin>.mcp_servers.<server>.identity.command.args — Ordered argument matchers for a plugin-bundled stdio server. The configured argument list must have the same length, and every position must match. plugins.<plugin>.mcp_servers.<server>.identity.command.executable — Executable that the plugin-bundled stdio server's configured command must match exactly. plugins.<plugin>.mcp_servers.<server>.identity — Identity rule for one plugin-bundled MCP server. Set either `command` (stdio) or `url` (streamable HTTP). mcp_servers.<id>.identity.url.match — Match operation for the configured MCP server URL. mcp_servers.<id>.identity.command.args[].match — Match operation for this argument position. mcp_servers.<id>.identity.command.args — Ordered argument matchers for a stdio server. The configured argument list must have the same length, and every position must match. Command matchers don't inspect `cwd`, `env`, or `env_vars`. mcp_servers.<id>.identity.command.executable — Executable that the stdio server's configured `command` must match exactly. marketplaces.allowed_sources.<name>.source — Marketplace source matcher type. Use `git` for one repository, `host_pattern` for Git hosts matched by regular expression, or `local` for one directory. marketplaces.allowed_sources.<name> — One allowed source rule. The final `source` value after requirements merge determines which sibling fields Codex interprets. marketplaces.allowed_sources — Allowed marketplace sources keyed by administrator-chosen rule name. Distinct names accumulate across requirements layers; fields under the same name use normal layer precedence. plugins.<plugin>.mcp_servers — Allowlist for MCP servers bundled with one plugin. Plugin server requirements use the same exact identity and matcher forms as top-level `mcp_servers` requirements. mcp_servers.<id>.identity.url.value — Value used by an `exact` or `prefix` URL matcher. mcp_servers.<id>.identity.url.expression — Regular expression used by a `regex` URL matcher. The expression must be valid and match the complete URL value.