Codex

Mint itr_rt_* in Settings → Runtime API keys. Keep upstream secrets in the Provider vault; clients should not need vendor sk- keys.

model_provider = "intertrace"

[model_providers.intertrace]
name = "OpenAI via Intertrace"
base_url = "https://intertrace.fly.dev/v1"
wire_api = "responses"
# API key / OPENAI_API_KEY → itr_rt_*

Or itr onboard --runtime codex --gateway https://intertrace.fly.dev. For tool calls, itr connect codex installs PreToolUse and PostToolUse hooks; trust them in Codex's /hooks. They deny on a pending or timed-out approval. Verify in Traffic. Related: OpenAI SDK · Control plane.