Install Codex on Windows
Published Jul 15, 2026 · Checked against the official docs
Install with PowerShell: run `powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"`, then run `codex` in your project and sign in with ChatGPT. Codex runs natively on Windows now, so the official docs default to the built-in Windows sandbox (elevated or unelevated), not WSL. Reach for WSL2 only when you need Linux-native tooling or neither sandbox mode works.
The fastest correct path on Windows is the PowerShell installer. Open PowerShell (a regular window is fine), run the one-liner, then start Codex in your project folder and sign in. Codex runs natively on Windows now, so you don’t need WSL to get going. The official docs default to the built-in Windows sandbox and only send you to WSL for the specific cases covered at the bottom.
Install it
- Install via PowerShell:
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"If you’d rather use a package manager and already have Node, the npm package installs the same CLI:
npm install -g @openai/codexcdinto a project directory and runcodex.- On first launch, pick Sign in with ChatGPT (or an API key). That starts an OAuth callback on
127.0.0.1:1455and opens your browser.
Latest stable is 0.144.4 as of July 14, 2026; the installer pulls it for you.
Native Windows sandbox
By default Codex sandboxes the commands it runs so the agent can’t touch anything outside your workspace. On Windows that’s the native sandbox, set in config.toml under the [windows] table:
[windows]
sandbox = "elevated" # or "unelevated"elevated is what the docs prefer. It builds real isolation from dedicated low-privilege sandbox users, filesystem permission boundaries, and firewall rules, and it needs a one-time UAC approval when the setup helper runs. unelevated uses a restricted Windows token derived from your own account with ACL-based boundaries. Reach for it on locked-down machines where you can’t approve elevation. Full breakdown on the windows.sandbox config page.
If it fails
Two Windows-specific failures hit people right after install:
- Login dies with
os error 10013on127.0.0.1:1455. Windows reserved the port range, so the OAuth server can’t bind. Fastest fix isnet stop winnatin an admin terminal, runcodex login, thennet start winnat. Full walkthrough at os error 10013. - A sandboxed command fails with
setup helper: 1223. The elevated setup helper couldn’t launch, so Codex can’t run commands in the sandbox. Dropping tounelevatedis the quick unblock; workarounds and version history are on the 1223 error page.
If elevated keeps dying and unelevated doesn’t cut it, that’s your signal to move to WSL2.
When to use WSL2 instead
The docs are specific: use WSL when you need Linux-native tooling, your workflow already lives in WSL2, or neither native sandbox mode works for you. For a plain Windows dev box, native is the recommended path. Setup for the Linux side is in the Linux / WSL install guide.