Fixie gives you a static IP address for your Codex agent so outbound HTTP and HTTPS requests can reach services that require IP whitelisting.

Use this setup when Codex needs to call a private API, webhook endpoint, SaaS admin API, internal tool, or any third-party service that only accepts traffic from approved IP addresses. Codex runs through Fixie, and the remote service sees your Fixie static IP addresses instead of the changing IP address of your local machine, app environment, IDE backend, or cloud environment.

This page is for HTTP and HTTPS requests from Codex. For databases, SSH, SFTP, FTP, and other raw TCP connections, use Fixie Socks with a SOCKS-aware client or fixie-wrench.

1. Create a Fixie HTTP/S proxy

Create a Fixie HTTP/S proxy in the Fixie Dashboard, then copy its proxy URL. It will look like:

http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80

Each Fixie proxy group has two static IP addresses. Add both IP addresses from the Fixie dashboard to the allowlist for the service your Codex agent needs to call.

2. Start Codex with Fixie proxy variables

For the Codex CLI, start Codex from a shell where the Fixie proxy variables are set:

export FIXIE_URL="http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80"
export HTTP_PROXY="$FIXIE_URL"
export HTTPS_PROXY="$FIXIE_URL"
export http_proxy="$FIXIE_URL"
export https_proxy="$FIXIE_URL"
export NO_PROXY="localhost,127.0.0.1,::1"
export no_proxy="$NO_PROXY"

codex -c 'sandbox_workspace_write.network_access=true'

The sandbox_workspace_write.network_access=true setting enables network access for command execution in the default workspace-write sandbox. If your Codex configuration already enables command network access, keep your existing network setting.

3. Allow Codex to forward the proxy variables

Codex forwards shell environment variables to spawned commands according to shell_environment_policy. If your ~/.codex/config.toml or project config uses include_only, add the proxy variables:

[shell_environment_policy]
include_only = [
  "PATH",
  "HOME",
  "FIXIE_URL",
  "HTTP_PROXY",
  "HTTPS_PROXY",
  "http_proxy",
  "https_proxy",
  "NO_PROXY",
  "no_proxy",
]

If you use the Codex app or IDE extension and it does not inherit your shell environment, put the exports in ~/.codex/.env, then restart the app or extension:

export FIXIE_URL="http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80"
export HTTP_PROXY="http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80"
export HTTPS_PROXY="http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80"
export http_proxy="http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80"
export https_proxy="http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80"
export NO_PROXY="localhost,127.0.0.1,::1"
export no_proxy="localhost,127.0.0.1,::1"

4. Configure Codex cloud environments

For Codex cloud environments, add the same values in the environment settings if the agent phase needs to call the IP-restricted service. Do not rely on export commands in the setup script; setup scripts run separately, so exported values do not persist into the agent phase.

If the environment uses a domain allowlist, allow the Fixie proxy hostname and the destination service domain.

Codex also has its own network sandbox and network proxy controls. Those controls decide whether commands may use the network and which destinations are allowed; they do not replace Fixie's static outbound IPs. When you enable Codex network policy, keep Fixie allowed:

[sandbox_workspace_write]
network_access = true

[features.network_proxy]
enabled = true
domains = { "**.usefixie.com" = "allow", "api.vendor.example" = "allow" }

5. Verify the static IP address

Run a request from the same Codex environment that will call the whitelisted service:

curl --proxy "$FIXIE_URL" http://welcome.usefixie.com
curl https://api.ipify.org

The first command verifies explicit Fixie proxy use. The second command verifies that the current shell environment is honoring the proxy variables.

Troubleshooting Codex static IP requests

If the remote service still sees the wrong IP address:

• Confirm both Fixie static IP addresses are on the remote service's allowlist.
• Confirm Codex command network access is enabled for the environment where the request runs.
• Confirm shell_environment_policy is not filtering out HTTP_PROXY, HTTPS_PROXY, or FIXIE_URL.
• For the Codex app or IDE extension, restart the app after changing ~/.codex/.env.
• For Codex cloud, put the values in environment settings rather than only exporting them in setup.
• For raw TCP use cases, switch to Fixie Socks or fixie-wrench.