Overview
Codex is OpenAI’s command-line coding agent. It connects to remote MCP servers over streamable HTTP natively and runs the OAuth flow itself, so no wrapper package is needed.Prerequisites
- A StackOne project you are a member of.
- A connector profile in the project for each provider the client should reach, with the actions you want exposed enabled.
- (Optional) A linked account for each provider. Accounts can also be linked during the consent flow.
Setup
1
Add the server to Codex
~/.codex/config.toml by hand:2
Approve the browser prompt
Walk through the consent screen
Walk through the consent screen
- Sign in to StackOne. If you are already signed in to the dashboard you skip straight to the next step.
- Select a project. Select the project you would like to associate the connection with.
- Select accounts and actions. Existing linked accounts are shown. New accounts can be linked by clicking + Link Account. You can either select the whole account (all actions will be granted) or refine by toggling individual actions.
- (Optional) Load tools when needed. On by default, and the toggle that puts the connection into Advanced Tool Search. Leave it on for large action sets. Turn it off to hand the agent every selected action up front.
- Authorize. Completes the connection; you can return to your client.
Select a project
Select accounts
Toggle actions
If you see a sentence where the Load tools when needed toggle should be, an admin has already settled it for the whole project. See project settings.
3
Verify
Run
codex and ask:codex mcp login stackone again. To revoke it, use Connected Apps in the StackOne dashboard.
Connecting with a session token instead
Connecting with a session token instead
A session token URL carries its own credential, so it covers the cases OAuth can’t: a shared server, a scheduled job, or anywhere nobody is present to approve a consent screen.Generate one from Connectors, open a connector, then Use in Agent. Pick a linked account, set the expiry (one year by default), and copy the URL:One URL covers one linked account, and anyone holding it has that access until it expires, so treat it like a password. See Choosing a connection method for the comparison with OAuth.There is no consent screen to set Advanced Tool Search on, so add the Put the token URL in For API-key auth instead, see Authentication & Security.
tool-mode query parameter instead:url instead:Optimize and secure
With your agent connected, use StackOne’s platform features to optimize performance and secure every call.Advanced Tool Search
Reduce context and save tokens.
Deep Query
Search synced records for a fraction of the tokens.
Defender
Block prompt injections before they reach your agent.