# How do I log in to Claude Code or Codex on a headless server? > Claude Code: paste the sign-in code back, use a claude setup-token token, or an API key. Codex: codex login --device-auth or an API key. Plus where each stores the login. - Source: Sanbox knowledge base, by Sanlabs GmbH - URL: https://sanbox.cloud/kb/coding-agents/log-in-to-claude-code-or-codex-on-a-headless-machine/ - Type: how-to - Section: Coding agents in the cloud - Language: en - Published: 2026-11-06 - Updated: 2026-11-06 You don't need a browser on the server. For Claude Code, run `claude`, open the sign-in URL on any other device and paste the code back; or create a one-year token with `claude setup-token` on a machine with a browser and set `CLAUDE_CODE_OAUTH_TOKEN` on the server; or use an API key. For Codex, run `codex login --device-auth` and enter the code on any device, or pipe an API key into `codex login --with-api-key`. On a Sanbox Computer you do the same in its terminal, and the login stays on the Computer's disk across stops. ## Run this with your agent ```text Read https://sanbox.cloud/kb/coding-agents/log-in-to-claude-code-or-codex-on-a-headless-machine.md and follow it to sign in to Claude Code or Codex on a remote machine. If the Sanbox CLI is missing, install it with `npm install -g @sanlabs/sanbox-cli@latest` and sign in with `sanbox login`. Show me each command before you create, stop or delete a Computer. ``` ## Which method should I use? | Method | Tool | Billed through | Good for | Limits | |---|---|---|---|---| | Sign-in URL, code pasted back | Claude Code | Your Claude plan | Interactive work, Remote Control | You type a code once | | `claude setup-token` | Claude Code | Your Claude plan | Scripts and CI | Model requests only, no Remote Control | | `ANTHROPIC_API_KEY` | Claude Code | Claude Console API usage | Automation | No Remote Control | | `codex login --device-auth` | Codex | Your ChatGPT plan | Interactive work | Beta; turn it on in ChatGPT settings | | `codex login --with-api-key` | Codex | OpenAI API usage | Automation, OpenAI's recommended default | The key is stored on the machine | | Copy `~/.codex/auth.json` | Codex | Your ChatGPT plan | When you can't use device code; check with your workspace admin | The file holds access tokens | ## Claude Code ### Sign in with a code from another device ```bash claude ``` Claude Code shows a sign-in URL. If no browser opens, copy the URL to your phone or laptop and sign in. When the browser shows a login code instead of returning to the terminal, paste it at the `Paste code here if prompted` prompt. `claude auth login` does the same before you start a session. Claude Code needs a Pro, Max, Ultra, Team, Enterprise or Console account. ### Use a long-lived token On a machine with a browser: ```bash claude setup-token ``` It runs the same browser flow, then prints a one-year OAuth token and saves it nowhere. On the server, set it as `CLAUDE_CODE_OAUTH_TOKEN`. Reading it without echoing keeps it out of your shell history: ```bash read -rs CLAUDE_CODE_OAUTH_TOKEN && export CLAUDE_CODE_OAUTH_TOKEN claude ``` Putting it in a shell profile instead stores it on disk. The token needs a Pro, Max, Ultra, Team or Enterprise plan. It can only make model requests, so it can't start Remote Control sessions or fetch claude.ai connectors, and bare mode (`--bare`) ignores it. ### Use an API key Set `ANTHROPIC_API_KEY` to a key from the Claude Console. In interactive mode Claude Code asks once whether to use it; with `-p` it always does. If you also have a subscription login, the approved API key wins, and `/status` shows which credential is in use. ### Where does Claude Code keep the login? On Linux, in `~/.claude/.credentials.json` with file mode 0600, or under `CLAUDE_CONFIG_DIR` if you set it. Anyone who can read that file can use your login. ## Codex ### Device code Turn on device code login in your ChatGPT security settings (or ask a workspace admin to allow it), then: ```bash codex login --device-auth ``` Open the link on any device, sign in and enter the one-time code. ### API key ```bash printenv OPENAI_API_KEY | codex login --with-api-key ``` OpenAI says API keys are still the recommended default for automation. ### Copy a login from another machine Sign in on a machine with a browser, check that `~/.codex/auth.json` exists, and copy it to the same path on the server. Treat it like a password. This doesn't apply if Codex stored the login in your system's credential store instead of the file. ### SSH port forwarding If you SSH in from a machine with a browser, forward the callback port and use the normal flow: ```bash ssh -L 1455:localhost:1455 @ codex login ``` Open the printed address on your own machine. ## Which hosts does sign-in need? - **Claude Code:** `claude.ai` and `platform.claude.com` for sign-in and token refresh, and `api.anthropic.com` for requests. The sign-in page itself opens on your device, not the server. - **Codex:** `api.openai.com` for API-key use. ChatGPT sign-in also uses `auth.openai.com` and `chatgpt.com`, which appear in Codex's source; check them against OpenAI's current docs. ## On a Sanbox Computer 1. Add the hosts above to the template's network policy, as in the [Claude Code](https://sanbox.cloud/kb/coding-agents/claude-code-24-7-from-your-phone/) and [Codex](https://sanbox.cloud/kb/coding-agents/codex-on-an-always-on-linux-computer/) guides. 2. Open a terminal on the running Computer: the console's browser terminal, or `sanbox ssh ` from yours. 3. Sign in with one of the methods above. For an API key, read it without echoing it, for example with `read -rs OPENAI_API_KEY && export OPENAI_API_KEY`, rather than typing it into a command line. 4. Stop and resume as usual. The login is a file on the Computer's disk, so it's still there after `sanbox runs resume --wait --json`. Things to know: - The console terminal and SSH sessions can use different home directories. Sign in from the one you'll keep using, or sign in in both. - Forks and snapshots copy files as they are, including logins. Take a snapshot before you sign in if others will start Computers from it. - People in your organisation who can open the run's terminal can use a login stored there. Plan logins are personal: on a Computer several people share, use an API key. - `sanbox exec` runs non-interactive commands, so use a terminal for the interactive sign-in flows. ## What this doesn't do - It doesn't keep keys away from the agent. Claude Code and Codex read their login from disk or the environment, and an agent running on the same machine can too. - Tokens expire. Claude Code warns three days before a `/login` sign-in expires, and the `claude setup-token` token lasts a year. - Sanbox doesn't manage these logins. You sign in inside the Computer, and the login lives in files there. ## Related - [How do I keep Claude Code running 24/7 and control it from my phone?](https://sanbox.cloud/kb/coding-agents/claude-code-24-7-from-your-phone/) - [How do I run OpenAI Codex on an always-on Linux computer instead of my laptop?](https://sanbox.cloud/kb/coding-agents/codex-on-an-always-on-linux-computer/) - [How do I give an AI agent API keys without exposing them?](https://sanbox.cloud/kb/security/api-keys-your-agent-cannot-see/) - [How do I restrict which domains an AI agent can reach?](https://sanbox.cloud/kb/security/restrict-which-domains-an-agent-can-reach/) ## Sources - Claude Code docs, [Authentication](https://code.claude.com/docs/en/authentication): sign-in flow, `claude setup-token`, `CLAUDE_CODE_OAUTH_TOKEN`, API key behaviour, credential storage, precedence, expiry warning. Checked 2026-11-06. - Claude Code docs, [Advanced setup](https://code.claude.com/docs/en/setup): supported account types. Checked 2026-11-06. - Claude Code docs, [Enterprise network configuration](https://code.claude.com/docs/en/network-config): sign-in and API hosts. Checked 2026-11-06. - Claude Code docs, [Remote Control](https://code.claude.com/docs/en/remote-control): API keys not supported. Checked 2026-11-06. - OpenAI docs, [Authentication](https://learn.chatgpt.com/docs/auth): device code, `--with-api-key`, `auth.json`, port forwarding, API keys for automation. Checked 2026-11-06. - GitHub, [openai/codex source](https://github.com/openai/codex): sign-in host `auth.openai.com` and ChatGPT backend `chatgpt.com`. Checked 2026-11-06. ## Next step Talk to us at sales@sanlabs.ai. Sanlabs' forward-deployed engineers build agent use cases with your team, with experience in aviation, pharmaceuticals, supply chain and logistics, and internal admin workflows. How we work: https://sanbox.cloud/kb/teams/forward-deployed-engineering.md Existing customers can use Sanbox from a coding agent: install the CLI with `npm install -g @sanlabs/sanbox-cli@latest`, sign in with `sanbox login`, then run `sanbox skill` for the full agent guide.