Reuse your coding agent subscription across workspaces

1. Seed auth.json once on your laptop or workstation outside of Domino, or inside a throwaway Domino workspace. Configure file-backed storage in ~/.codex/config.toml:
   cli_auth_credentials_store = "file"
   
   Then log in:
   codex login
   
   Confirm that auth.json was created. Typical locations:
   • macOS / Linux: ~/.codex/auth.json
   • Windows: %USERPROFILE%\.codex\auth.json (usually C:\Users\<you>\.codex\auth.json)
   • Custom: wherever $CODEX_HOME points, if you set it
   If the file exists, you’re good to continue.
2. In Account Settings > User environment variables, add:
   • Name: CODEX_AUTH_JSON
   • Value: the entire contents of your auth.json file, pasted as-is.
3. In the environment’s pre-run script, materialize the file. A user or admin adds this once to the Compute Environment:
   export CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
   mkdir -p "$CODEX_HOME" && chmod 700 "$CODEX_HOME"
   # only seed if missing; do NOT overwrite a refreshed file every run
   [ -f "$CODEX_HOME/auth.json" ] || printf '%s' "$CODEX_AUTH_JSON" > "$CODEX_HOME/auth.json"
   chmod 600 "$CODEX_HOME/auth.json"
   
4. Run codex normally in the workspace. It refreshes the token bundle in place when the session is stale (roughly every 8 days) and writes the new tokens back to auth.json.

​

How long the seed lasts

• The access token (used for API calls) is a JWT valid for roughly a week. The CLI proactively refreshes once last_refresh is older than roughly 8 days. Multiple workspaces using the same still-valid access token simultaneously is fine.
• The refresh token is rotated on use. When any copy refreshes, the server issues a new refresh token and invalidates the old one. Every other copy of the credential (other workspaces, the CODEX_AUTH_JSON seed value, and even your laptop) then holds a dead refresh token and gets a 401 the next time it tries to refresh.

• the seed you pasted into Domino weeks ago is probably already past its refresh, and
• a long-running workspace that refreshes first can knock your laptop out of its session.

• If refresh stops working (401 responses), reseed. Run a fresh codex login on your laptop and re-paste auth.json into the CODEX_AUTH_JSON user environment variable.
• The home directory of a workspace is typically ephemeral. A fresh workspace gets the seed from CODEX_AUTH_JSON, not the last refreshed file, so keep the seed reasonably fresh.
• This does not apply to API-key auth or chatgptAuthTokens host integrations.

1. Create a fine-grained personal access token once:
   • Resource owner: your personal account (not an organization).
   • Permission: Copilot Requests (only available on user-owned fine-grained PATs).
   • Repository access: as needed for your work.
   Classic PATs (ghp_) are not supported. The token looks like github_pat_....
2. In Account Settings > User environment variables, add:
   • Name: COPILOT_GITHUB_TOKEN
   • Value: github_pat_...

• An environment variable silently overrides any stored OAuth token. If GH_TOKEN is set for another tool (a common setup in Domino environments for Git access), the CLI may use that instead. COPILOT_GITHUB_TOKEN wins the precedence order, so set it explicitly rather than relying on GH_TOKEN.
• Billing: smaller included models don’t consume premium requests; more capable models draw on premium quota. Use --model to pick cheaper models for automation.
• This is the standalone Copilot CLI, not the VS Code extension. The CLI is the right tool for headless workspaces.