Summary
Codex 0.164.0, released on October 23, 2026, introduces significant changes to how agents authenticate with MCP servers behind enterprise gateways. The update allows for two authentication methods: reusing existing Codex account grants and a dedicated sign-in for the MCP server. This release also addresses OAuth clients that require secrets, enhancing compatibility with various enterprise identity setups.
The update includes several practical improvements, such as preserving authorization across runtime refreshes and providing clearer error messages when authentication fails. Users are advised to update to the new version and check documentation for specific configuration syntax, particularly regarding client secrets, which should be handled with care to avoid exposure in shared repositories.
Additional features include enhanced credential masking during remote command executions and the automatic activation of the Amazon Bedrock Setup Wizard when AWS credentials are detected. The release also resolves several minor issues, such as preserving configuration overrides and improving connection handling on Windows systems. Users are encouraged to familiarize themselves with the new features and adjustments to optimize their use of Codex.
Show Notes
Codex 0.164.0 adds enterprise MCP authentication using eligible Codex account grants or dedicated sign-in, including support for OAuth clients that require secrets. Learn what to verify before configuring a gateway, plus caveats around remote MCP settings, token refresh, credential masking, and several useful CLI and session fixes.
More from The Codex Changelog
Learn why transitioning between the Codex CLI and Desktop app can trigger thread writer lock errors caused by the managed app server daemon's 30-minute grace period. We explore workarounds like selective daemon stops, chat forking, and the unconfirmed --no-daemon flag, alongside fixes and bugs from recent 0.164.0 and 0.165.0 alpha releases.
Codex CLI 0.164.0 enables the Amazon Bedrock setup wizard by default, making it easier to use detected AWS credentials or a Bedrock bearer token. We cover the Mantle endpoint, setup options for local use and CI, and practical caveats around regional model availability, token lifetimes, IAM permissions, and request costs—plus several smaller release improvements.
Codex 0.164.0 adds inline arguments to /model and /permissions, letting you switch models, reasoning effort, speed, and permission profiles without navigating pickers. Learn a practical workflow for saving those combinations in /presets, plus caveats around unsupported settings and resumed sessions.
A closed background-compaction channel could leave a Codex app-server turn stuck in progress; learn the reported recovery steps and the fix associated with PR 55581, whose release availability is still unclear. We also cover an open report of queued input disappearing when pre-turn compaction is interrupted, plus notes on CLI voice disconnects, installer download-host selection, and GPT 5.5 retirement.
Codex’s new PromptCacheKey policy lets hosts keep session identity separate from prompt-cache routing. Learn how to choose a shared key for parallel subagents, omit the field for compatible gateways, and reapply the policy when resuming threads—plus caveats for cache hits and prompt consistency. Also: updates to fork-prefix preservation, authentication errors, Guardian metrics, and compaction recovery.