Masaka · Codex Multiple Environments is a standalone open-source command-line account management tool for switching between multiple isolated ChatGPT accounts and ChatGPT workspaces in the official Codex CLI, without repeatedly logging out and logging back in. It does not replace the Codex UI, nor is it another agent CLI; users add, check, renew, delete, or select Profiles via the masaka command, and then run native codex commands as usual.
Main uses:
- Keep Personal, Business, and Enterprise workspaces logged in at the same time.
- Keep multiple ChatGPT accounts isolated from each other even when they share the same workspace name.
- Check each Profile's authentication status, token activity, 5-hour/weekly quota windows, reset times, and available rate limit reset cards.
- Select the identity used by the next native Codex process via /use.
- Renew a Profile without logging out or invalidating other Profiles.
- Prevent concurrent re-authentication while a Profile is in use.
Main capabilities:
- Each Profile represents exactly one (ChatGPT account, ChatGPT workspace) combination and has its own CODEX_HOME. Codex remains responsible for the official browser login, token refresh, and credential files.
- Provides shell integration so that ordinary codex commands can also use Profile selection.
- Provides an optional hot-switching local Proxy: on Apple Silicon macOS, installs a proxy runtime bound to a version and SHA-256 via a one-time bootstrap process, a per-user launchd daemon, and enables Proxy mode.
- /auto true is the default routing policy: sticky routing to preserve prompt cache locality, switching only when the active account's 5-hour window has 5% or less remaining, is unavailable, or is in cooldown; automatic priority is Pro → Business/Team → other plans, and within the same plan group, the one with more remaining capacity is preferred. /order can be used to specify an explicit order.
- Provides /usage to report the server-authoritative availableCount; card detail lines may be truncated or missing, so the count may be greater than the number of displayed lines.
UsageMethod:
- Requirements: macOS or Linux, Node.js 22+, Python 3, and the official Codex CLI.
- Open masaka to add, inspect, renew, delete, or select a Profile, then run the native codex command normally.
- Shell integration: add the integration line to ~/.zshrc (use ~/.bashrc for Bash) to enable Profile selection for ordinary codex commands. Masaka only prints the integration content and never automatically edits shell files.
- If you previously used a codex alias to set default parameters, first move those parameters into an array, then place the integration line, and then start Codex as usual.
- Every slash command has a terminal form, for example masaka status or masaka use 2.
- Optional Proxy bootstrap: on Apple Silicon macOS, run the one-time bootstrap process to download and install a per-user daemon and enable Proxy mode; after the initial setup, restart any existing Codex clients once. After that, /use changes the account/workspace routing for their next request without interrupting responses already in progress.
Use cases:
- Developers who need to switch frequently between personal, team, or enterprise workspaces.
- Users who want to keep isolation between multiple ChatGPT accounts while continuing to use the official Codex CLI.
- Users who need to view quota windows, reset times, and reset cards for each account.
- Developers who need to manage Codex identities from the command line on macOS or Linux.
Limitations and security notes:
- Only macOS or Linux is supported, requiring Node.js 22+, Python 3, and the official Codex CLI.
- In direct mode, /use only affects future Codex processes; in Proxy mode it can route the next request of an already running client, but responses in progress remain on the original account.
- The global ~/.codex/auth.json is never copied, linked, or replaced.
- Profile credentials must be regular files, not symbolic links or hard links.
- Proxy mode supports multiple native Codex sessions because only the daemon is responsible for OAuth refresh; direct mode allows one managed session per Profile, and renewal and deletion also require that Profile's exclusive lock.
- Profile directories have permissions 0700; metadata and credential files are 0600 on platforms that support POSIX permissions.
- Masaka stores display metadata only in ~/.config/cx/cx-state.json; secrets remain under Codex-owned ~/.codex-workspaces/profiles/.
- The optional runtime is the MIT-licensed proxy CodexMulti, pinned to v0.2.15 and verified with SHA-256 before extraction.
- By design, no additional encryption layer is added; when cli_auth_credentials_store="file", Codex stores credentials in auth.json under the Profile's CODEX_HOME, and it should be treated as a password.
- If connected through Proxy, using /proxy off waits for responses in progress, stops the daemon, and hands token refresh ownership back to direct mode; clients that were connected through Proxy must be restarted to prevent two processes from refreshing the same token.
- This tool is independently developed by MASAKA AI, is not an official OpenAI product, and is not endorsed by OpenAI.
- Licensed under Apache-2.0; see SECURITY.md for security reports.