# One Account, One Container: How Codex Hosted Isolation Works

Sign-in on your own machine, no password custody, one isolated container per ChatGPT account, never pooled, AES-256-GCM for stored keys. The Codex Hosted security model, explained.

*Published 2026-06-12 · https://proxyllm.ai/blog/codex-hosted-architecture-isolated-containers*

The Codex Hosted security model fits in one sentence: one ChatGPT account, one isolated container, signed in by you on your own machine, never pooled, never shared, disconnectable at any time. We never hold your password, and stored fallback keys are encrypted with AES-256-GCM. This page unpacks each clause, because trust claims are only useful when you can check them against a mechanism. For the product overview first, see [what is Codex Hosted?](/blog/what-is-codex-hosted)

## Why isolation is the design center

OpenAI's Terms of Use are precise about accounts: you may not share credentials or make your account available to anyone else, and you are responsible for activity under your account. The gray market fails exactly here. Resellers pool bulk accounts and sell slices of them, which is the behavior the terms name.

Codex Hosted is built as the counter-model. Your subscription serves you, full stop. With no pooling there is no shared-capacity engine to optimize, no incentive to blend traffic, and nothing to resell. One account, one container is the only mode we run. The account clauses, quoted and read closely, are in [sharing an OpenAI account: what the terms say](/blog/is-sharing-openai-account-against-tos).

## Sign-in without password custody

Connecting an account starts with OpenAI's own login command, run by you on your own machine:

```text
1. You run codex login on your machine. Your browser opens, you sign in
   at chatgpt.com as yourself, and Codex writes a session file locally.
2. You run proxyllm codex connect. It uploads that session file to your
   container, and we store it encrypted at rest.
3. Your container comes up signed in as you, and serves only you.
```

At no point does a password cross our systems. There is no password field anywhere in this flow, so there is no password for us to store, mishandle, or leak. What we do hold is the session file you chose to upload: encrypted at rest, working only inside your container, gone when you disconnect.

## What runs inside your container

Each container runs the official, unmodified Codex CLI under your ChatGPT session, plus the queue that serializes your requests. It accepts work only from requests authenticated with your ProxyLLM keys. Connect a second account you own and it gets a second, equally isolated container; the gateway treats the two as ordered fallback lanes, never as a blended pool.

## Credential custody, in one table

| Credential        | Where it lives                       | What we can do with it                |
| ----------------- | ------------------------------------ | ------------------------------------- |
| ChatGPT password  | with you and OpenAI only             | nothing; it never reaches us          |
| Codex session     | inside your container                | run your requests on your plan        |
| Fallback API keys | encrypted at rest, AES-256-GCM       | decrypted only to serve your requests |
| ProxyLLM API keys | issued by us, scoped to your account | authenticate your apps at the gateway |

## What never happens

- Your account joining a pool that serves other customers.
- Capacity from your plan being resold to anyone.
- Another customer's request running in your container, or yours in theirs.
- A ProxyLLM page asking for your OpenAI password. If you ever see one, you are not on our flow; close it.

## Disconnecting is always available

Disconnect an account in the dashboard at any time: the container shuts down and the session goes with it. You can also sign the session out from your own OpenAI account, which kills it from OpenAI's side. Reconnecting later is the same one-minute sign-in and connect command described in the [setup guide](/blog/codex-hosted-setup-guide).

## Where the terms fit

Isolation is an engineering choice in service of a policy stance. Programmatic Codex use through `codex exec` is documented, intended functionality, and device-code sign-in for remote machines is documented too. OpenAI's terms still govern your account, and OpenAI has the final call on its services. We keep the design inside the documented account rules, and our [terms](/terms) commit to complying immediately if OpenAI directs a change. The complete reading is in [is Codex Hosted against OpenAI's terms?](/blog/is-codex-hosted-against-openai-terms)

The standard we hold ourselves to: trust should be verifiable rather than promised. OpenAI's own sign-in screen shows you exactly what you are authorizing, the request log shows every call your container served, and disconnect is a button, not a support ticket.

If the model holds up to your read, [Codex Hosted](/) takes about five minutes to try, and disconnecting takes one click if it does not fit.