Configure local ChatGPT Work and Codex surfaces to use OpenAI models available through Amazon Bedrock. In this setup, the local client sends model requests to Bedrock using AWS-managed authentication and access controls.
How it works
When you configure a local ChatGPT Work or Codex surface with Amazon Bedrock as the model provider, the OpenAI-hosted Responses API isn’t in the request path. The local client sends model requests to Amazon Bedrock, and Bedrock provides an OpenAI-compatible Responses API implementation for supported OpenAI models.
Authentication is AWS-native. Users authenticate with a Bedrock API key or AWS
IAM credentials. They do not use ChatGPT sign-in or OPENAI_API_KEY for this
provider.
Before you start
Make sure you have:
- Access to supported OpenAI models in Amazon Bedrock.
- An AWS Region where the selected model is available.
- Authentication for the Amazon Bedrock Mantle path configured for the AWS account.
Configure the provider
Add the amazon-bedrock model provider for the Amazon Bedrock Mantle path to
~/.codex/config.toml. The ChatGPT desktop app, Codex CLI, IDE extension, and
SDK read the same local configuration layers. Supplying a model is optional.
Select a supported model explicitly when needed.
model_provider = "amazon-bedrock"This guide covers the Amazon Bedrock Mantle path in supported commercial AWS Regions. Local ChatGPT Work and Codex surfaces don’t support Bedrock Mantle endpoints in AWS GovCloud Regions.
Authentication options
Local ChatGPT Work and Codex surfaces support two Bedrock authentication paths. They check them in this order:
- Bedrock API key.
- AWS SDK credential chain.
Option 1: Bedrock API key
Set the Bedrock API key in the environment the local client reads. You must specify a Region when using API-key authentication.
export AWS_BEARER_TOKEN_BEDROCK=<your-bedrock-api-key>
export AWS_REGION=us-east-2Option 2: AWS SDK credentials
Use this path when your organization manages Bedrock access through the AWS SDK credential chain. The local client can use these standard AWS SDK credential sources:
Shared AWS configuration files
Configure the shared AWS config and credentials files:
aws configureEnvironment variables
Set the standard AWS SDK credential environment variables:
export AWS_ACCESS_KEY_ID=<your-access-key-id>
export AWS_SECRET_ACCESS_KEY=<your-secret-access-key>
export AWS_SESSION_TOKEN=<your-session-token>AWS Management Console credentials
Log in with AWS Management Console credentials:
aws loginAWS SSO or a named profile
Log in with AWS SSO and select the named profile:
aws sso login --profile codex-bedrock
export AWS_PROFILE=codex-bedrockFederated identity
For corporate SSO or OIDC federation, configure a federated identity with
credential_process outside the local client and let the AWS SDK resolve
credentials. Put browser login, token exchange, caching, and refresh in your
AWS profile’s credential_process helper.
Desktop app and IDE extension
Desktop apps and IDE extensions may not inherit environment variables from the
shell. Put required values in ~/.codex/.env, then restart the app or
extension.
export AWS_BEARER_TOKEN_BEDROCK=<your-bedrock-api-key>
export AWS_REGION=us-east-2Verify setup
- In Codex CLI, open
/statusand confirm Codex is using theamazon-bedrockmodel provider. - In the ChatGPT desktop app, select Work or Codex and start a new task after restarting the app.
- In the IDE extension, start a new session after restarting the extension.
- Confirm the selected model is available in the configured AWS Region and that the AWS identity has permission to access it.
Supported models
Use exact model IDs:
openai.gpt-5.6-sol
openai.gpt-5.6-terra
openai.gpt-5.6-luna
openai.gpt-5.5
openai.gpt-5.4Model availability varies by AWS Region. Before selecting a model, see model support by AWS Region.
Feature availability
This configuration supports local ChatGPT Work and Codex workflows. Hosted ChatGPT Work on the web, Codex cloud, and features that depend on OpenAI-hosted cloud services, hosted tools, or cloud-managed discovery aren’t currently available.
Fast Mode isn’t available with Amazon Bedrock. Fast Mode uses priority processing, and the initial Amazon Bedrock offering supports on-demand inference only.
Detailed feature availability
* Feature is currently limited to only specific regions. Check the individual feature documentation to learn more about geo restrictions.
† Local plugin bundles are supported when their capabilities do not require ChatGPT authentication. OpenAI-curated plugin discovery and features that depend on connectors or cloud-hosted sharing aren’t available.
Troubleshooting
If setup fails, check the following:
- The model ID exactly matches a supported model.
- You specify an AWS Region where the model is available.
- The Bedrock API key or AWS credentials are valid and not expired.
- The AWS identity has permission to access the selected Bedrock model.
AWS_BEARER_TOKEN_BEDROCKisn’t set to an expired or unintended key.- For desktop app or IDE extension usage, required environment variables are
present in
~/.codex/.env.
Support boundaries
OpenAI Support can help with ChatGPT Work and Codex client setup, configuration, local CLI behavior, desktop app behavior, IDE extension behavior, and the local product experience.
For AWS credentials, IAM permissions, Bedrock model access, quotas, billing, regional availability, Bedrock request failures, AWS service logs, or Bedrock service behavior, contact the customer’s AWS administrator or AWS Support.