Using Codex and Claude Code through one gateway: setup guide

Plenty of teams don't standardize on one coding agent. Some engineers prefer Claude Code, others Codex, and a few switch depending on the task, or on whose usage limit reset last. That's fine until someone asks what the team spent on coding agents last month, and the answer spans two providers, several shared keys and a spreadsheet.

This guide sets up both tools to go through one gateway. Every engineer gets one key with one budget, and every session lands in one set of logs, whichever agent they ran. We use TokenRouter, which we build, but the tool-side config also shows what to look for in any gateway.

Why this works: two protocols, one gateway

Claude Code speaks the Anthropic Messages API (/v1/messages). Codex CLI speaks the OpenAI Responses API (/v1/responses) and supports custom model providers. A gateway that serves both natively can sit in front of both tools, with no wrappers or forks.

TokenRouter serves /v1/messages natively for Anthropic clients, passing requests to Claude models through verbatim. For OpenAI-shaped clients it serves /v1/responses, plus /v1/chat/completions and /v1/embeddings.

Step 1: connect providers, set budgets, create keys

In the console:

1. Connect providers. Open Provider Keys → Add Provider Key and add each provider you'll use, for example Anthropic and OpenAI. The Free plan connects 2 providers, and paid plans connect all 13.
2. Invite the engineers. Under Members → Invite member, add each engineer with the Member role and pick their team.
3. Set a daily hard cap per engineer. Under Budgets → Create budget, set Scope to Member, Period to Daily, a dollar limit, and the hard-cap switch on. Alerts go out at 50%, 80% and 100% by default. Daily budgets reset at 00:00 UTC.
4. Have each engineer create their own key under API Keys → Create key, with an RPM and TPM limit. Keys a member creates are tied to them, so their member budget covers every key they own. That means one budget covers both tools, whether they use one key for both or one key per tool.

One key for both tools (say agents-alice) is simplest. One key per tool (claude-code-alice, codex-alice) gives you a clean Claude Code vs Codex cost comparison, under the same person's budget.

When a hard cap would be crossed, the request is refused before it reaches the provider with 429 budget_exceeded. Rate-limit breaches return 429 rate_limit_exceeded with a Retry-After header.

Step 2: Claude Code

export ANTHROPIC_BASE_URL=https://api.tokenrouter.io
export ANTHROPIC_AUTH_TOKEN=tr_your_key_here
claude

There's no /v1 on this base URL. Anthropic clients append /v1/messages themselves. ANTHROPIC_API_KEY=tr_... works too. Add both lines to your shell profile.

Verify:

claude -p "Reply with exactly: routed via TokenRouter"

Step 3: Codex CLI

Add a provider to ~/.codex/config.toml. This base URL does include /v1, the opposite of Claude Code:

model = "openai/gpt-5-mini"
model_provider = "tokenrouter"

[model_providers.tokenrouter]
name = "TokenRouter"
base_url = "https://api.tokenrouter.io/v1"
env_key = "TOKENROUTER_API_KEY"
wire_api = "responses"

Then:

export TOKENROUTER_API_KEY=tr_your_key_here
codex "explain what this repo does"

Codex sends stateless Responses calls and resends the context each turn. That matches TokenRouter's Responses implementation, so no previous_response_id is needed.

Step 4 (optional): opencode

opencode takes any OpenAI-compatible provider. In opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "tokenrouter": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "TokenRouter",
      "options": {
        "baseURL": "https://api.tokenrouter.io/v1",
        "apiKey": "{env:TOKENROUTER_API_KEY}"
      },
      "models": {
        "openai/gpt-5-mini": { "name": "GPT-5 mini" },
        "anthropic/claude-sonnet-4-5": { "name": "Claude Sonnet 4.5" },
        "auto": { "name": "TokenRouter Auto" }
      }
    }
  }
}

Step 5: pick models per tool, or let the router pick

Models are addressed as provider/model across all 13 providers, and the same ID works on every endpoint that takes a model field. Any routed model works in Codex's model field, including Anthropic models such as anthropic/claude-sonnet-4-5. TokenRouter translates Responses calls to each provider's native API, so Codex can run against a Claude model through the same key:

model = "anthropic/claude-sonnet-4-5"

On paid plans you can pass auto with a strategy: auto:cost, auto:latency, auto:quality or auto:balanced. The router picks among providers you have keys for and respects the team's model allowlist. The chosen model comes back in the response's model field and shows up in analytics, so attribution stays exact. On the Free plan, auto returns 403 auto_routing_unavailable, so pass an explicit model.

A reasonable pattern: keep agents on explicit models you've tested, and use auto:cost for side jobs like summarizing logs.

Step 6: one place to see spend

Every request from either tool is tied to a key, and a member-created key also ties it to that engineer and their team. Analytics and CSV exports break spend down by team, member, key, model and provider. With separate keys per tool, that's also a direct Claude Code vs Codex cost comparison for your own team. It's more useful than per-token prices, because the same model can cost very different amounts per task depending on the harness.

A rollout checklist for a team

1. Start with two volunteers, one on each tool, for a week. Use member budgets with the hard-cap switch off, so nobody gets blocked while you learn what normal looks like.
2. Find each person's heaviest normal day in analytics, then turn the hard cap on with a limit comfortably above it. The cap is there to stop loops, not to ration work.
3. Set a TPM limit on every key, so a retry loop gets throttled in minutes instead of discovered at the end of the day.
4. Once you know which models the team actually uses, add a team model allowlist (Model Access).
5. Write the two env vars and the Codex provider block into your onboarding doc, including the /v1 difference between them.
6. Offboarding becomes simple: revoke that person's keys and remove them from Members.

Known issues to test before a team rollout

Both tools change fast, and some open issues affect any gateway or custom provider:

• Claude Code: the desktop app's Code tab ignores ANTHROPIC_BASE_URL from settings.json (#97574). Any non-default base URL drops message threads and reduces parallel tool calls in headless runs (#98464). /model on resumed sessions may not show proxied models (#98540).
• Codex: several open issues report custom-provider sessions failing to archive, or losing the provider's model catalog after an update (openai/codex#48367, #48961, #49227, #50282). Pin versions for team rollouts and recheck after upgrades.

Troubleshooting

• 404 from Claude Code: check for /v1 on ANTHROPIC_BASE_URL.
• 403 model_not_allowed: the model isn't on that team's allowlist.
• 429 budget_exceeded vs rate_limit_exceeded: the first means the request would go past a hard cap for the current period. The second means slow down and retry after the Retry-After delay.
• 502 upstream_error: the gateway couldn't get a good response from the provider on your key.

---

We build TokenRouter. The free plan needs no card. Setup guides for Claude Code, Codex, opencode and zcode are in the docs: tokenrouter.io/docs/codex.

Comments

[Manoj Kumar Kagitha]

One key, one budget across both tools is the detail that matters. We run an LLM gateway with per-tenant metering at work, and the moment you can answer what the team spent last month without a spreadsheet, the gateway has paid for itself.