Codex Grok: Use Grok 4.6 & 4.5 with OAuth or API

This guide shows you how to add Grok 4.6 and 4.5 to the Codex model picker with Codex Router. Grok offers two authentication paths—the official Grok CLI OAuth session and a separately billed xAI API key—and the OAuth path adds hosted web search and x_search tools. Grok 4.6 is currently an OAuth route; the separately billed API route remains Grok 4.5.

GrokOAuthAPI key

What you can add

Choose your authentication

• Grok OAuth reuses the official Grok CLI credential at ~/.grok/auth.json. The router sends it only to xAI’s documented Grok CLI inference proxy. On this path, the router also attaches bare hosted web_search and x_search tools — the same agentic surface Grok Build uses — and xAI’s backend decides when to search and how to filter results.
• Grok API uses a separately billed xAI API key entered through a hidden prompt. Use this if you do not want to install the Grok CLI, or on Windows where Smart App Control may block the CLI (see below).

Enable Grok OAuth

Install the official Grok CLI and authenticate:

npm install -g @xai-official/grok
grok login --oauth

Then enable the provider:

./bin/model-router codex providers enable grok-oauth
./bin/model-router codex doctor

The OAuth token stays in ~/.grok/auth.json and is sent only to the Grok CLI inference proxy. Never copy it into Codex config, an API-key file, or an environment variable.

Enable Grok API

./bin/model-router codex provider-key grok-api set
./bin/model-router codex providers enable grok-api

On Windows, use ./codex-router.ps1 codex provider-key grok-api set. The hidden prompt disables terminal echo and the key is stored in a protected per-user file.

Verify the integration

./bin/model-router codex doctor
./bin/model-router codex providers

The chosen provider must report SHOW and ready. Then fully quit Codex, reopen it, create a new task, and check the picker for Grok 4.6 or 4.5. For a live check:

./bin/test-model 'grok-oauth/grok-4.6' --live --yes

Grok 4.6 and the optional Fast tier

The OAuth route publishes Grok 4.6 with a 500K context window, text and image input, hosted web/X search, reasoning levels low, medium, high and xhigh, plus the optional priority service tier shown as Fast in clients that support service-tier controls. Fast is opt-in per request: Codex Router never enables it globally and never forwards it to a failover model that does not advertise the tier.

Long Grok reasoning pauses are kept alive with bounded heartbeats, and failed or incomplete repair attempts now reach Codex as terminal errors instead of releasing a partial private answer or silently replaying a billed turn.

Windows caveat: Smart App Control

On Windows, Smart App Control can block the official Grok CLI. If grok --version reports spawn UNKNOWN, “An Application Control policy has blocked this file,” or a Smart App Control notification, Grok OAuth cannot complete login or refresh its session. Keep Smart App Control enabled — it does not offer a safe per-app bypass — and use the grok-api provider with an xAI API key instead:

./model-router.ps1 codex provider-key grok-api set
./model-router.ps1 codex providers enable grok-api
./model-router.ps1 codex doctor

An OAuth session created while the executable was allowed is not a durable workaround: the router invokes the official CLI again near token expiry, so the session eventually stops refreshing if Windows blocks the executable later.

Common pitfalls

• OAuth and API are separate billing systems. A Grok CLI subscription does not pay for grok-api usage, and an xAI API key cannot refresh a Grok OAuth session.
• Search behavior is upstream-controlled. The router attaches the search tools but takes no search env knobs or request-side filter configuration; xAI decides when and how to search.
• Provider policy risk. xAI may restrict or block proxy traffic. Using Grok through Codex Router is at your own risk.

Official links

• Grok CLI (npm)
• xAI API

Related: models overview, Windows install notes, troubleshooting.