How do I log in to Claude Code or Codex on a headless server?

You don't need a browser on the server. For Claude Code, run claude, open the sign-in URL on any other device and paste the code back; or create a one-year token with claude setup-token on a machine with a browser and set CLAUDE_CODE_OAUTH_TOKEN on the server; or use an API key. For Codex, run codex login --device-auth and enter the code on any device, or pipe an API key into codex login --with-api-key. On a Sanbox Computer you do the same in its terminal, and the login stays on the Computer's disk across stops.

Run this with your agent

Read https://sanbox.cloud/kb/coding-agents/log-in-to-claude-code-or-codex-on-a-headless-machine.md and follow it to sign in to Claude Code or Codex on a remote machine.
If the Sanbox CLI is missing, install it with `npm install -g @sanlabs/sanbox-cli@latest`
and sign in with `sanbox login`. Show me each command before you create, stop or delete a Computer.

Which method should I use?

Method	Tool	Billed through	Good for	Limits
Sign-in URL, code pasted back	Claude Code	Your Claude plan	Interactive work, Remote Control	You type a code once
`claude setup-token`	Claude Code	Your Claude plan	Scripts and CI	Model requests only, no Remote Control
`ANTHROPIC_API_KEY`	Claude Code	Claude Console API usage	Automation	No Remote Control
`codex login --device-auth`	Codex	Your ChatGPT plan	Interactive work	Beta; turn it on in ChatGPT settings
`codex login --with-api-key`	Codex	OpenAI API usage	Automation, OpenAI's recommended default	The key is stored on the machine
Copy `~/.codex/auth.json`	Codex	Your ChatGPT plan	When you can't use device code; check with your workspace admin	The file holds access tokens

Claude Code

claude

Claude Code shows a sign-in URL. If no browser opens, copy the URL to your phone or laptop and sign in. When the browser shows a login code instead of returning to the terminal, paste it at the Paste code here if prompted prompt. claude auth login does the same before you start a session. Claude Code needs a Pro, Max, Ultra, Team, Enterprise or Console account.

Use a long-lived token

On a machine with a browser:

claude setup-token

It runs the same browser flow, then prints a one-year OAuth token and saves it nowhere. On the server, set it as CLAUDE_CODE_OAUTH_TOKEN. Reading it without echoing keeps it out of your shell history:

read -rs CLAUDE_CODE_OAUTH_TOKEN && export CLAUDE_CODE_OAUTH_TOKEN
claude

Putting it in a shell profile instead stores it on disk. The token needs a Pro, Max, Ultra, Team or Enterprise plan. It can only make model requests, so it can't start Remote Control sessions or fetch claude.ai connectors, and bare mode (--bare) ignores it.

Use an API key

Set ANTHROPIC_API_KEY to a key from the Claude Console. In interactive mode Claude Code asks once whether to use it; with -p it always does. If you also have a subscription login, the approved API key wins, and /status shows which credential is in use.

On Linux, in ~/.claude/.credentials.json with file mode 0600, or under CLAUDE_CONFIG_DIR if you set it. Anyone who can read that file can use your login.

Codex

Device code

Turn on device code login in your ChatGPT security settings (or ask a workspace admin to allow it), then:

codex login --device-auth

Open the link on any device, sign in and enter the one-time code.

API key

printenv OPENAI_API_KEY | codex login --with-api-key

OpenAI says API keys are still the recommended default for automation.

Sign in on a machine with a browser, check that ~/.codex/auth.json exists, and copy it to the same path on the server. Treat it like a password. This doesn't apply if Codex stored the login in your system's credential store instead of the file.

SSH port forwarding

If you SSH in from a machine with a browser, forward the callback port and use the normal flow:

ssh -L 1455:localhost:1455 <user>@<server>
codex login

Open the printed address on your own machine.

Claude Code: claude.ai and platform.claude.com for sign-in and token refresh, and api.anthropic.com for requests. The sign-in page itself opens on your device, not the server.
Codex: api.openai.com for API-key use. ChatGPT sign-in also uses auth.openai.com and chatgpt.com, which appear in Codex's source; check them against OpenAI's current docs.

On a Sanbox Computer

Add the hosts above to the template's network policy, as in the Claude Code and Codex guides.
Open a terminal on the running Computer: the console's browser terminal, or sanbox ssh <run-id> from yours.
Sign in with one of the methods above. For an API key, read it without echoing it, for example with read -rs OPENAI_API_KEY && export OPENAI_API_KEY, rather than typing it into a command line.
Stop and resume as usual. The login is a file on the Computer's disk, so it's still there after sanbox runs resume <run-id> --wait --json.

Things to know:

The console terminal and SSH sessions can use different home directories. Sign in from the one you'll keep using, or sign in in both.
Forks and snapshots copy files as they are, including logins. Take a snapshot before you sign in if others will start Computers from it.
People in your organisation who can open the run's terminal can use a login stored there. Plan logins are personal: on a Computer several people share, use an API key.
sanbox exec runs non-interactive commands, so use a terminal for the interactive sign-in flows.

What this doesn't do

It doesn't keep keys away from the agent. Claude Code and Codex read their login from disk or the environment, and an agent running on the same machine can too.
Tokens expire. Claude Code warns three days before a /login sign-in expires, and the claude setup-token token lasts a year.
Sanbox doesn't manage these logins. You sign in inside the Computer, and the login lives in files there.

Sources

Claude Code docs, Authentication: sign-in flow, claude setup-token, CLAUDE_CODE_OAUTH_TOKEN, API key behaviour, credential storage, precedence, expiry warning. Checked 2026-11-06.
Claude Code docs, Advanced setup: supported account types. Checked 2026-11-06.
Claude Code docs, Enterprise network configuration: sign-in and API hosts. Checked 2026-11-06.
Claude Code docs, Remote Control: API keys not supported. Checked 2026-11-06.
OpenAI docs, Authentication: device code, --with-api-key, auth.json, port forwarding, API keys for automation. Checked 2026-11-06.
GitHub, openai/codex source: sign-in host auth.openai.com and ChatGPT backend chatgpt.com. Checked 2026-11-06.