ChatGPT & Codex

Connection Overview

ChatGPT Enterprise - OpenAI Compliance API

Use one dedicated OpenAI Admin key to let Targetboard read ChatGPT Enterprise compliance data and analytics.

1. Login to the OpenAI Admin Console and navigate to Credentials > Admin keys.
2. Create a new key for TargetBoard.
   Create the key with Restricted permissions. Under Compliance, grant Read access to every available Compliance API category, including sensitive scopes when available. Also grant Read access to the workspace analytics/costs and Codex analytics categories. Set every other category to None.
   Do not grant Write, Delete, All, model-inference, service-account administration, spend-control, or workspace-management permissions.
   Because full Compliance read access can include sensitive workspace data, a Workspace Owner should create the key.
3. Share the key securely with your TargetBoard contact.

Codex - OpenTelemetry

Configure Codex on developer machines to send both OTLP logs and OTLP metrics to the company's own OpenTelemetry collector using OTLP/gRPC on port 4317.

1. Configure Codex on each developer machine.
   Save the following settings to ~/.codex/config.toml. Replace <COMPANY_OTEL_COLLECTOR> with the hostname or IP address of the company collector.
2. Set user identity for logs and metrics.
   Set user.email as an OpenTelemetry resource attribute in the developer shell environment so both Codex logs and metrics carry the company email. Codex config.toml does not currently support custom OTEL resource attributes.

Codex configuration (OTLP/gRPC - logs + metrics):

[otel]
          environment = "prod"
          log_user_prompt = false
          
          [otel.exporter.otlp-grpc]
          endpoint = "http://<COMPANY_OTEL_COLLECTOR>:4317"
          protocol = "binary"
          
          [otel.metrics_exporter.otlp-grpc]
          endpoint = "http://<COMPANY_OTEL_COLLECTOR>:4317"
          protocol = "binary"

Required user identity (environment variable):

export COMPANY_EMAIL="<developer-company-email>
          "export OTEL_RESOURCE_ATTRIBUTES="user.email=${COMPANY_EMAIL}"
          
          # Reload the shell profilesource ~/.zshrc
          

3. Restart Codex
   Reload the shell profile, then close and reopen Codex so the OTEL configuration and OTEL_RESOURCE_ATTRIBUTES value take effect.
4. Verify rollout.

Minimum requirements for Codex OTEL coverage

• Codex with OpenTelemetry support.
• Network access from developer machines to the company OTEL collector on OTLP/gRPC port 4317.
• Both the OTEL log exporter and metrics exporter configured.
• OTEL_RESOURCE_ATTRIBUTES includes user.email=${COMPANY_EMAIL}, with COMPANY_EMAIL set to the developer's company email.
• log_user_prompt = false so prompt content is not exported.