Codex Grok: Use Grok 4.7, 4.6 & 4.5 with OAuth or API

This guide shows you how to add Grok 4.7, 4.6 and 4.5 to the Codex model picker with Codex Router. Grok offers two authentication paths—the official Grok CLI OAuth session and a separately billed xAI API key—and the OAuth path adds hosted web search and x_search tools. Grok 4.7 is available through OAuth and the separately billed API.

GrokOAuthAPI key

What you can add

Choose your authentication

• Grok OAuth reuses the official Grok CLI credential at ~/.grok/auth.json. The router sends it only to xAI’s documented Grok CLI inference proxy. On this path, the router also attaches bare hosted web_search and x_search tools — the same agentic surface Grok Build uses — and xAI’s backend decides when to search and how to filter results.
• Grok API uses a separately billed xAI API key entered through a hidden prompt. Use this if you do not want to install the Grok CLI, or on Windows where Smart App Control may block the CLI (see below).

For Grok-family routes, Codex Router now adapts known workspace instruction paragraphs to Grok’s available file tools. The published guidance names read_file, grep, list_dir and search_replace, and tells Grok to send independent reads as separate calls instead of using the unavailable multi_tool_use.parallel tool. This changes the instructions Grok sees, not the tools or authentication configured for your route.

Enable Grok OAuth

Install the official Grok CLI and authenticate:

npm install -g @xai-official/grok
grok login --oauth

Then enable the provider:

./bin/model-router codex providers enable grok-oauth
./bin/model-router codex doctor

The OAuth token stays in ~/.grok/auth.json and is sent only to the Grok CLI inference proxy. Never copy it into Codex config, an API-key file, or an environment variable.

Enable Grok API

./bin/model-router codex provider-key grok-api set
./bin/model-router codex providers enable grok-api

On Windows, use ./codex-router.ps1 codex provider-key grok-api set. The hidden prompt disables terminal echo and the key is stored in a protected per-user file.

Verify the integration

./bin/model-router codex doctor
./bin/model-router codex providers

The chosen provider must report SHOW and ready. Then fully quit Codex, reopen it, create a new task, and check the picker for Grok 4.7, 4.6 or 4.5. For a live check:

./bin/test-model 'grok-oauth/grok-4.6' --live --yes

Grok 4.7

Grok 4.7 is checked in on grok-oauth, grok-api, OpenCode Go, Command Code, Nous Research and OpenRouter. The 500K context accepts text and images. OAuth and OpenRouter offer low/medium/high/xhigh; Command Code stays at low/medium/high. The direct OAuth and API routes now offer optional Fast; the 4.7 OAuth route still has no v2 subagent certification.

Direct Grok routes and the optional Fast tier

The OAuth route publishes Grok 4.6 with a 500K context window, text and image input, hosted web/X search and reasoning levels low, medium, high and xhigh. The optional priority service tier shown as Fast is now offered on all direct xAI presets: OAuth 4.5/4.6/4.7 and API 4.5/4.7. Fast is opt-in per request: Codex Router never enables it globally or forwards it to a failover model that does not advertise the tier. Fully quit and reopen Codex after updating so its model controls reload. Reseller routes keep their own provider behavior.

Long Grok reasoning pauses are kept alive with bounded heartbeats, and failed or incomplete repair attempts now reach Codex as terminal errors instead of releasing a partial private answer or silently replaying a billed turn.

For Grok OAuth 4.6/4.7, structured editing now uses typed patches and whole-line replace_lines by default while keeping native permissions and terminal parameters. Set CODEX_ROUTER_GROK_STRUCTURED_PATCH=0 in the router service environment to keep native patch text. A completed short answer is accepted without a speculative retry based on reasoning-token counts; after a tool result, only an empty completed response without a tool call receives one bounded recovery attempt.

The context estimate sent to Codex now reflects the final provider request rather than accumulated internal search prompts. Actual billed tokens remain in the local usage ledger, while failed Grok streams report a terminal error instead of being replayed.

Windows caveat: Smart App Control

On Windows, Smart App Control can block the official Grok CLI. If grok --version reports spawn UNKNOWN, “An Application Control policy has blocked this file,” or a Smart App Control notification, Grok OAuth cannot complete login or refresh its session. Keep Smart App Control enabled — it does not offer a safe per-app bypass — and use the grok-api provider with an xAI API key instead:

./model-router.ps1 codex provider-key grok-api set
./model-router.ps1 codex providers enable grok-api
./model-router.ps1 codex doctor

An OAuth session created while the executable was allowed is not a durable workaround: the router invokes the official CLI again near token expiry, so the session eventually stops refreshing if Windows blocks the executable later.

Common pitfalls

• OAuth and API are separate billing systems. A Grok CLI subscription does not pay for grok-api usage, and an xAI API key cannot refresh a Grok OAuth session.
• Search behavior is upstream-controlled. The router attaches the search tools but takes no search env knobs or request-side filter configuration; xAI decides when and how to search.
• Provider policy risk. xAI may restrict or block proxy traffic. Using Grok through Codex Router is at your own risk.

Official links

• Grok CLI (npm)
• xAI API

Related: models overview, Windows install notes, troubleshooting.