OpenAI Gateway is a FastAPI service that sits between anything speaking the OpenAI SDK and one or more real ChatGPT Codex accounts. Point an OpenAI client at it, authenticate with one gateway master key, and it forwards the request upstream using OAuth credentials pulled from an actual Codex CLI login, with no per-token API billing involved.
It exists because of a problem raised by Spores, another one of these projects: Spores delegates coding tasks to a Codex CLI agent running inside a disposable sandbox, and paying per-token API rates for every one of those runs did not scale. A Codex CLI login credential is a subscription token, not an API key, so it is not something you can just paste into a sandbox and call done. OpenAI Gateway takes that subscription credential and re-exposes it as a normal OpenAI-compatible HTTP API, so Spores’ sandbox, or anything else, can point at it and get Codex-quality completions billed against a subscription instead of API usage.
Two OpenAI-compatible surfaces: a chat completions endpoint translated to and from the Responses API, and a near-verbatim responses passthrough, plus a models listing and a health check
Multi-account routing: drop several Codex credential files into the auth folder and the gateway load-balances across them with a pluggable strategy, stable priority order with fallback on failure by default, even rotation, or quota-aware routing that favors whichever account has the most quota left
Automatic OAuth refresh ahead of expiry, so a long-running service never trips over an expired token mid-request
Quota- and cooldown-aware: an account that gets rate-limited is benched for a cooldown window and skipped entirely until it recovers; accounts over their daily limit are skipped the same way
Idempotency-key deduplication so retried requests do not get double-executed, and double-billed against a subscription’s usage, if a client retries after a timeout
OpenCode Go support alongside Codex accounts, including an Anthropic-Messages-compatible surface for the models published that way
Authenticated dashboard and status endpoint to see which accounts, models, and endpoints are live right now
OpenAI’s Responses API and its older Chat Completions API are not the same wire format, and this gateway needs to accept Chat Completions requests but only speak Responses to the real Codex backend. The translation layer carries that weight in both directions, including the streaming equivalents, so a client using the plain OpenAI SDK against the chat completions endpoint genuinely cannot tell it isn’t talking to OpenAI directly, streaming included.
A Codex CLI login produces a credential file meant for one interactive session on one machine, not something designed to serve concurrent requests from a multi-tenant backend indefinitely. The gateway treats each account’s file as a managed, rotating resource, loaded, saved, and deleted, including through the dashboard, rather than a static secret, and refreshes tokens ahead of expiry so it can run unattended for long stretches without a login prompt ever reappearing.
With several Codex accounts sitting behind one gateway key, a naive always-try-the-first-available-account strategy starves whichever account is last in the list and hammers whichever is first. Quota-aware routing exists specifically so load spreads by remaining daily quota rather than by list order, the difference between one account silently getting rate-limited every day and the pool actually behaving like a pool.
This one is plumbing, but plumbing that changes the economics of running an agent like Spores: instead of every delegated coding task metering against a per-token API bill, the whole fleet of sandboxes shares a small pool of Codex subscriptions through one endpoint that behaves exactly like the real OpenAI API. The account-router and quota logic ended up mattering more than the translation layer, a gateway that silently exhausts its one account by mid-morning isn’t a gateway.
