Redact environment variable secrets in Codex

Pass environment variable secrets to Codex while redacting matching values from its output.

Codex receives the real environment variables, but any matching values it prints are replaced with [REDACTED].

Prerequisite

Install the Codex CLI to get the codex command.

$ npm install -g @openai/codex
$ codex --version

Get the Dotenvx CLI.

$ curl -sfS https://dotenvx.sh | sh
◈ installed (dotenvx)

more install options

Add a secret to your .env file.

$ echo "HELLO=World" > .env

Run Codex with your real secrets while redacting them from its output.

$ dotenvx run --redact -- codex exec 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --skip-git-repo-check
Hello [REDACTED]