Support Amazon Bedrock project for cost attribution

@celia-oai — sorry for the direct ping; you've owned most of the built-in Bedrock provider work, so you're likely the right person for this.

Quick context: Bedrock Projects is currently the only workload-level cost-attribution mechanism on bedrock-mantle. Application inference profiles only cover bedrock-runtime, and IAM principal attribution is still "coming soon" for mantle (and attributes by identity, not workload). The OpenAI-Project header is exactly what AWS documents for this.

I have a working, tested implementation here: https://github.com/konippi/codex/pull/1 — it adds an optional aws.project setting and sends it as the OpenAI-Project header on Mantle requests, same pattern as your x-amzn-mantle-client-agent header in #21840. Config-only and off by default.

Since external contributions are invitation-only, would the team be open to a PR for this?

Yes please move on this PR/issue, it's currently necessary for cost attribution for AWS Bedrock.

I would add a request that the project configuration be able to be specified in .codex/config.toml of the project directory. The current implementation reads from ~/.codex/config.toml (global)

[model_providers.amazon-bedrock.aws]
project = "proj_xxxxxxxxxxxxxxxx"

Good call — this now works in a repo's project-local .codex/config.toml, not just the global ~/.codex/config.toml:

[model_providers.amazon-bedrock.aws]
project = "proj_xxxxxxxxxxxxxxxx"

Project-local config previously dropped the whole model_providers table for security; the PR carves out just aws.project (it only tags requests — can't redirect traffic or credentials) and gates it behind the existing project-trust check. A repo-level value overrides the global one.

I would love to see this get merged! I spent a few hours yesterday trying and failing multiple different ways to get Codex to use a specific Bedrock Mantle project. It seems that Codex just straight up ignores the setting no matter how I try to configure it to use a specific project.

From all the things I found online, all routes have failed.

• Using ~/.zshrc with export OPENAI_PROJECT="proj_fewafewa"
• Using ~/.codex/.env with OPENAI_PROJECT="proj_fewafewa"
• Using ~/.codex/config.toml with openai_project = "proj_fewafewa" and openai_base_url = "https://bedrock-mantle.us-east-1.api.aws/openai/v1"
• Using ~/.codex/config.toml with http_headers = { "OpenAI-Project" = "proj_fewafewa" } under [model_providers.amazon-bedrock.aws]

@etraut-openai
Sorry for the direct ping; I'm currently creating a pull request on a repo I've already forked. Would it be possible for me to contribute to the upstream repository?

might have been fixed today.. https://github.com/openai/codex/commit/315195492c80fdade38e917c18f9584efd599304.

support for http_headers on aws bedrock

might have been fixed today.. 3151954. support for http_headers on aws bedrock

Awesome! Do you know the release cadence for the client? Interested to try this out ASAP!

> might have been fixed today.. 3151954. > support for http_headers on aws bedrock Awesome! Do you know the release cadence for the client? Interested to try this out ASAP!

Wish i knew :( but i validated it is sending custom http headers to bedrock!

Great! I believe that will work for specifying the Mantle project ID right?

Great! I believe that will work for specifying the Mantle project ID right?

yes my config.toml has

[model_providers.amazon-bedrock]
http_headers = { "OpenAI-Project" = "proj_xxxxxxxxxxxxxx" }

model_providers.amazon-bedrock] http_headers = { "OpenAI-Project" = "proj_xxxxxxxxxxxxxx" }

Hmmm. This doesn't appear to be working for me. 🤔 I'm on ChatGPT 26.715.21425 and the app says that's the latest version.

<img width="255" height="213" alt="Image" src="https://github.com/user-attachments/assets/4ae0f1c7-12b0-47ed-a9d3-3eff8e89a9b0" />

I tried the Codex CLI as well with version 0.144.5 and got validation errors from my ~/.codex/config.toml

➜  ~ codex --version
codex-cli 0.144.5

Here are some ~/.codex/config.toml excerpts that I've tried.

When I use this with the ChatGPT app, it prompts me to sign in to OpenAI which indicates it's not picking up on my 3P inference config at all.
For Codex CLI, it gives the error message Error loading configuration: model_providers.amazon-bedrock only supports changing aws.profile and aws.region; other non-default provider fields are not supported

[model_providers.amazon-bedrock]
profile = "regular"
region = "us-east-1"
http_headers = { "OpenAI-Project" = "proj_xxxxxxxxxxxxxx" }

When I use this with the ChatGPT app, it works (no OpenAI sign in prompt) but it still routes to the default project in Mantle.
For Codex CLI, it launches but still routes to the default project in Mantle.

[model_providers.amazon-bedrock.aws]
profile = "regular"
region = "us-east-1"
http_headers = { "OpenAI-Project" = "proj_xxxxxxxxxxxxxx" }

When I try a combination with the ChatGPT app, it prompts me to sign in to OpenAI.
For Codex CLI, it gives the error message Error loading configuration: model_providers.amazon-bedrock only supports changing aws.profile and aws.region; other non-default provider fields are not supported.

[model_providers.amazon-bedrock]
http_headers = { "OpenAI-Project" = "proj_xxxxxxxxxxxxxx" }

[model_providers.amazon-bedrock.aws]
profile = "regular"
region = "us-east-1"

Any thoughts @francisreyes-tfs?

For Codex CLI, it gives the error message Error loading configuration: model_providers.amazon-bedrock only supports changing >aws.profileandaws.region; other non-default provider fields are not supported. `` [model_providers.amazon-bedrock] http_headers = { "OpenAI-Project" = "proj_xxxxxxxxxxxxxx" } [model_providers.amazon-bedrock.aws] profile = "regular" region = "us-east-1" ``

The error message you pasted tells me you didn't rebuild with the latest checkout from git. The commit references the error message should be ' "model_providers.amazon-bedrock only supports changing base_url, auth, http_headers, aws.profile, and aws.region; other non-default provider fields are not supported"'

When evaluating codex from github directly I only consider the CLI version. I don't know about the app, it seems they are two completely different products from a development point of view.

If you have tokens and reasonable dev utilities, you can have codex (any version really) do this for you:

"Pull the latest version of codex from the codex repository, https://github.com/openai/codex, and use install.md from the docs directory of that repository to build an executable. Give me the exact path to the built executable to run from the command line"

Just beware, you're building from a code commit, not an official (?) released version from OpenAI. I've got guardrails on the bedrock session token codex uses in case something strange/nefarious occurs.

That makes good sense to me. Seems that it just hasn't been released yet. Having to build from source is something that we'd rather not have to do so we'll just wait until the next release that includes the project support.

Thanks for confirming with me here!