Use Squiid with
Codex

What Codex is

Codex is OpenAI software engineering agent. It comes as a command line tool, an IDE extension and a cloud environment that works on tasks in your repository and opens pull requests. The cloud version runs in a sandboxed container, so anything it needs at runtime has to be supplied as an environment variable in the environment configuration rather than read from your laptop.

The problem: every agent wants keys

The moment a coding agent stops writing a component and starts wiring up a product, it needs credentials. A database URL for Supabase. A deploy token for Vercel. An API key for Resend. Another for Twilio, another for Stripe, another for whichever model provider the feature calls. Each one is a signup, a dashboard, a billing relationship and a secret that has to exist somewhere Codex can reach.

What happens next is worse than a long .env file. People paste secrets into prompts to get better answers, and keys end up in chat transcripts, in screenshots posted for help, and in committed config. Because each key belongs to a different vendor, rotating one after a leak means finding it, regenerating it and updating every place it was copied to.

The fix: one key, one convention

Squiid holds the upstream credentials for every service in the catalog. Your project gets one variable:

SQUIID_API_KEY=sq_live_xxxxxxxxxxxxxxxxxxxx

Then every call your app or your agent makes goes to the gateway with that one key:

curl https://api.squiid.io/v1/supabase/... \
  -H "Authorization: Bearer $SQUIID_API_KEY"

Official SDKs take a base URL, so most integrations are a one line change rather than a rewrite:

import { createClient } from '@supabase/supabase-js';

const db = createClient(
  'https://api.squiid.io/v1/supabase',
  process.env.SQUIID_API_KEY,
);

That is the gateway convention: https://api.squiid.io/v1/<service>/ with Authorization: Bearer $SQUIID_API_KEY. It is the same for every service, which is why an agent only has to learn it once. Full detail is on the gateway convention page.

Setting it up in Codex

• For the Codex CLI, configuration lives in a config file under ~/.codex/. Your project .env is still what your application reads, so SQUIID_API_KEY goes there as usual.
• For Codex cloud tasks, set environment variables and secrets in the environment settings for the repository rather than committing them. Check the Codex documentation for where that panel lives in your version, since the interface has moved between releases.
• Add the gateway convention to AGENTS.md in the repository root. Codex reads that file as instructions for the repo, which is the natural place to say that every outbound call goes through the Squiid gateway.

Agent tooling changes quickly. Where a file path or a settings panel is named above, confirm it against the agent own current documentation before relying on it.

What it costs

Usage is paid from prepaid credits at par: $1 of credit is $1 at the provider, no markup. The free plan is $0/month with a 15% fee on credit top-ups and a $50 minimum top-up. Solo is $19.97/month and its top-up fee starts at 8%, falling to 6.5%, 5% and 3.5% as trailing 30-day API spend passes $100, $500 and $2,000. Team is $29.97 per seat per month for seats 1-5, $24.97 for seats 6-20 and $19.97 above that, with the same ladder one point lower. Custom pricing is 3% or less against a commitment. Subscription-priced services such as Supabase Pro at $25 a month pass through at the provider price with no fee. Credits pause at zero rather than overdrawing, with alerts at 75%, 90% and 100%. See spend controls.