Codex not starting on highly restricted network

Open 💬 5 comments Opened Mar 11, 2026 by ATofighi

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex CLI is running?

codex-cli 0.111.0

What subscription do you have?

chatgpt plus / remote openai api with custom base url

Which model were you using?

gpt5.4 / custom opensource model

What platform is your computer?

Linux 6.8.0-101-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

We use codex on highly restricted network which only some specific domains are allowed and there is no access to other ip or domains.

I'm using codex with a custom openai base_url which is allowed in our network. but in new version of codex I get this error:

codex
Error loading configuration: timed out waiting for cloud requirements after 15s

What steps can reproduce the bug?

Use codex on a highly restricted network which almost everything blocked using iptables!

What is the expected behavior?

I should be able to start codex and use it using a custom base url

Additional information

It seems that If I turn off my network, I can start codex and then everything works well.

View original on GitHub ↗

5 Comments

github-actions[bot] contributor · 5 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#12996

Powered by Codex Action

etraut-openai contributor · 5 months ago

How are you configuring the alternate base URL? Are you defining a separate custom model provider, or are you using the built-in openai provider but using the OPENAI_BASE_URL environment variable?

ATofighi · 5 months ago

How are you configuring the alternate base URL? Are you defining a separate custom model provider, or are you using the built-in openai provider but using the OPENAI_BASE_URL environment variable?

I defined a custom provider:

my ~/.codex/config.toml:

model = "gpt-5.4"
model_reasoning_effort = "xhigh"
personality = "pragmatic"
model_provider = "mycustomprovider"

[model_providers.mycustomprovider]
name = "mycustomprovider"
base_url = "https://llm.ourlocaldomain"
env_key = "CUSTOM_LLM_API_KEY"

[features]
unified_exec = true
collaboration_modes = true
multi_agent = true

llm.ourlocaldomain backend is https://github.com/BerriAI/litellm/tree/main if it can help

alexsong-oai contributor · 5 months ago

@ATofighi Are you an Enterprise user and signed in with ChatGPT? If so, Codex enforces loading managed configuration from the cloud.
Based on what you described, this is likely related to your restricted network, where only specific domains are allowlisted. Could you check whether this base URL is reachable from your environment?
https://chatgpt.com/backend-api
For loading managed configuration requirements specifically, Codex uses:
https://chatgpt.com/backend-api/wham/config/requirements
Can you whitelist both of them?

ATofighi · 5 months ago

@ATofighi Are you an Enterprise user and signed in with ChatGPT? If so, Codex enforces loading managed configuration from the cloud. Based on what you described, this is likely related to your restricted network, where only specific domains are allowlisted. Could you check whether this base URL is reachable from your environment? https://chatgpt.com/backend-api For loading managed configuration requirements specifically, Codex uses: https://chatgpt.com/backend-api/wham/config/requirements Can you whitelist both of them?

Thanks, yes these base urls are not reachable. You are right. I removed ~/.codex/auth.json file and the issue is gone. I think that if model provider is not default or codex using api key, it should not try to get cloud config from chatgpt, or should not be blocking.