Skip to main content
Corridor integrates with Codex cloud environments to catch security vulnerabilities before code is committed. When configured, every cloud session installs the Corridor CLI and a git pre-commit hook that scans staged changes and blocks commits containing security findings.

​
Prerequisites

  • A Corridor account with a team created
  • Owner role on your Corridor team
  • A Codex account with permission to edit cloud environments
  • The repository imported into Corridor as a project

​
Setup

1

Open the Long-Running Agents page in Corridor

In the Corridor dashboard, navigate to Governance > Long-Running Agents and click the Configuration tab.Select Codex from the agent options.
2

Open your Codex environment settings

Go to chatgpt.com/codex/cloud/settings/environments, select the environment you want to configure, and click Edit.
3

Generate a Corridor API key

Back in the Corridor Configuration tab, enter a name for your key (for example, “Codex cloud agents”) and click Generate key.Copy the full API key that is displayed in the modal. Note that the key is only shown once.
4

Add the API key as a secret in Codex

In your Codex environment settings, add a secret:
  • Name: CORRIDOR_API_KEY
  • Value: the API key you copied
5

Paste the setup script

Copy the setup script shown in the Corridor Configuration timeline and paste it into the environment’s Setup script field, then save:
The script runs at the start of every cloud session. It installs the Corridor CLI and a git pre-commit hook that runs corridor scan --staged before each commit.
Each session installs the Corridor CLI when it starts, so the environment needs outbound network access. If your environment restricts network access, add these domains to the allowlist:
  • app.corridor.dev
  • github.com
  • release-assets.githubusercontent.com

​
How it works

Once configured, every Codex cloud session will:
  1. Install the Corridor CLI
  2. Install a git pre-commit hook
  3. Scan staged changes before each commit
  4. Block commits that contain security findings
The hook is installed per repository when the session starts, so a repository cloned later in the same session is not covered. Findings caught by the pre-commit scan appear in the Usage tab of the Long-Running Agents page, where you can review severity, affected files, and resolution status.

​
Managing API keys

You can view and revoke API keys in the Configuration tab under Team-Owned API Keys. Each key shows its name, creation date, and last used date. To rotate a key:
  1. Generate a new key in Corridor
  2. Update the CORRIDOR_API_KEY secret in your Codex environment
  3. Revoke the old key

​
Next steps

Guardrails

Configure the security rules that your agents enforce.

Findings

Learn how to review and resolve security findings.