> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corridor.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Codex

> Set up Corridor with Codex cloud to scan code for security vulnerabilities before every commit.

Corridor integrates with [Codex](https://chatgpt.com/codex) cloud environments to catch security vulnerabilities before code is committed. When configured, every cloud session installs the Corridor CLI and a git pre-commit hook that scans staged changes and blocks commits containing security findings.

## Prerequisites

* A Corridor account with a team created
* **Owner** role on your Corridor team
* A Codex account with permission to edit cloud environments
* The repository imported into Corridor as a project

## Setup

<Steps>
  <Step title="Open the Long-Running Agents page in Corridor">
    In the [Corridor dashboard](https://app.corridor.dev), navigate to **Governance > Long-Running Agents** and click the **Configuration** tab.

    Select **Codex** from the agent options.
  </Step>

  <Step title="Open your Codex environment settings">
    Go to [chatgpt.com/codex/cloud/settings/environments](https://chatgpt.com/codex/cloud/settings/environments), select the environment you want to configure, and click **Edit**.
  </Step>

  <Step title="Generate a Corridor API key">
    Back in the Corridor Configuration tab, enter a name for your key (for example, "Codex cloud agents") and click **Generate key**.

    Copy the full API key that is displayed in the modal. Note that the key is only shown once.
  </Step>

  <Step title="Add the API key as a secret in Codex">
    In your Codex environment settings, add a secret:

    * **Name:** `CORRIDOR_API_KEY`
    * **Value:** the API key you copied
  </Step>

  <Step title="Paste the setup script">
    Copy the setup script shown in the Corridor Configuration timeline and paste it into the environment's **Setup script** field, then save:

    ```bash theme={null}
    curl -fsSL https://app.corridor.dev/cli/codex-setup.sh | sh
    ```

    The script runs at the start of every cloud session. It installs the Corridor CLI and a git pre-commit hook that runs `corridor scan --staged` before each commit.
  </Step>
</Steps>

<Note>
  Each session installs the Corridor CLI when it starts, so the environment needs outbound network access. If your environment restricts network access, add these domains to the allowlist:

  * `app.corridor.dev`
  * `github.com`
  * `release-assets.githubusercontent.com`
</Note>

## How it works

Once configured, every Codex cloud session will:

1. Install the Corridor CLI
2. Install a git pre-commit hook
3. Scan staged changes before each commit
4. Block commits that contain security findings

The hook is installed per repository when the session starts, so a repository cloned later in the same session is not covered.

Findings caught by the pre-commit scan appear in the **Usage** tab of the Long-Running Agents page, where you can review severity, affected files, and resolution status.

## Managing API keys

You can view and revoke API keys in the **Configuration** tab under **Team-Owned API Keys**. Each key shows its name, creation date, and last used date.

To rotate a key:

1. Generate a new key in Corridor
2. Update the `CORRIDOR_API_KEY` secret in your Codex environment
3. Revoke the old key

## Next steps

<CardGroup cols={2}>
  <Card title="Guardrails" icon="shield-check" href="/features/guardrails">
    Configure the security rules that your agents enforce.
  </Card>

  <Card title="Findings" icon="magnifying-glass" href="/features/findings">
    Learn how to review and resolve security findings.
  </Card>
</CardGroup>