What Codex CLI needs

Codex CLI reaches any OpenAI-compatible endpoint through a custom model provider block in ~/.codex/config.toml.

model_provider names an entry under [model_providers.*], and the two spellings have to match exactly.
env_key names the environment variable holding the key, so the key itself never enters the config file.
wire_api selects the request shape. The generated block uses "responses"; if the provider documents only /chat/completions, change it to "chat", because a mismatch fails as a 404 or a schema error on the very first request.
The file has to be the user-level one. Codex ignores project-level .codex/config.toml keys that redirect provider authentication, including model_provider.

The file this produces

Running npx free-llm-api setup codex writes config.toml. It is generated from the catalog, so the base URL and model id are the ones the provider documents rather than ones you have to look up. Here it is filled in for GroqCloud:

# Merge this snippet into ~/.codex/config.toml.
# Project-level config cannot select a custom model provider.
model = "llama-3.3-70b-versatile"
model_provider = "groq"

[model_providers.groq]
name = "GroqCloud OpenAI-compatible gateway"
base_url = "https://api.groq.com/openai/v1"
env_key = "GROQ_API_KEY"
wire_api = "responses"

Nothing in that file is a key. The value is read from GROQ_API_KEY at run time, which is the one habit that keeps a credential out of a repository by construction.

Which free tiers fit Codex CLI

22 providers here serve the OpenAI protocol and take no credit card, which makes them the ones worth trying first with Codex CLI. The full list, including the ones that do ask for a card, is in the catalog.

Provider	Base URL	Published limits
Google Gemini API	`https://generativelanguage.googleapis.com/v1beta/openai/`	Set by project tier
GroqCloud	`https://api.groq.com/openai/v1`	30 requests per minute, 1000 requests per day
SambaNova Cloud	`https://api.sambanova.ai/v1`	20 requests per minute, 20 requests per day
Cohere	`https://api.cohere.ai/compatibility/v1`	20 requests per minute
Cloudflare Workers AI	`https://api.cloudflare.com/client/v4/accounts/ACCOUNT_ID/ai/v1`	Published in compute units
Hugging Face Inference Providers	`https://router.huggingface.co/v1`	Published as a credit balance
SiliconFlow	`https://api.siliconflow.com/v1`	1000 requests per minute
Fireworks AI	`https://api.fireworks.ai/inference/v1`	10 requests per minute

What to expect on a free tier

Codex sends large context windows for repository work, so a provider with a generous requests-per-day count can still cut you off on tokens per day. Read both columns before committing to one provider.

Before blaming the client, check the key itself: the browser checker separates a rejected credential from a rate limit from an endpoint that is simply down, and each of those has a different fix.

Sources

Codex advanced configuration and custom model providers

Provider figures shown here come from each provider’s own documentation, reviewed on 2026-07-25. The methodology covers what is recorded and what is deliberately left blank.