Observability for OpenAI Codex with Opik

OpenAI Codex supports opt-in OpenTelemetry export through Codex configuration files.

Use this guide if you run Codex (CLI/IDE/app) and want its OTEL trace exporter to send telemetry to Opik.

Codex reads configuration from:

• user config: ~/.codex/config.toml
• project config: .codex/config.toml

See Codex config basics.

For Opik OTEL endpoint behavior, see Opik OpenTelemetry overview.

[otel]
environment = "prod"
log_user_prompt = false

[otel.trace_exporter.otlp-http]
endpoint = "https://www.comet.com/opik/api/v1/private/otel/v1/traces"
protocol = "binary"
headers = { "Authorization" = "<your-api-key>", "Comet-Workspace" = "<your-workspace>", "projectName" = "<your-project-name>" }

[otel]
environment = "prod"
log_user_prompt = false

[otel.trace_exporter.otlp-http]
endpoint = "https://<comet-deployment-url>/opik/api/v1/private/otel/v1/traces"
protocol = "binary"
headers = { "Authorization" = "<your-api-key>", "Comet-Workspace" = "<your-workspace>", "projectName" = "<your-project-name>" }

[otel]
environment = "prod"
log_user_prompt = false

[otel.trace_exporter.otlp-http]
endpoint = "http://localhost:5173/api/v1/private/otel/v1/traces"
protocol = "binary"
headers = { "projectName" = "<your-project-name>" }

Intent: Route Codex OTEL trace export to Opik with project/workspace attribution.

Applies when: You have enabled Codex OTEL export and selected OTLP/HTTP exporter in config.

Required fields:

• an [otel.trace_exporter.otlp-http] table. The table itself selects the exporter; do not also write trace_exporter = "otlp-http" as a string under [otel], Codex rejects the file with cannot extend value of type string with a dotted key.
• endpoint
• protocol (binary or json, binary recommended)

Optional fields:

• headers (projectName strongly recommended)
• otel.environment
• otel.log_user_prompt (keep false unless policy allows prompt export)

Minimal valid config:

[otel]
log_user_prompt = false

[otel.trace_exporter.otlp-http]
endpoint = "https://www.comet.com/opik/api/v1/private/otel/v1/traces"
protocol = "binary"
headers = { "Authorization" = "<your-api-key>", "Comet-Workspace" = "<your-workspace>", "projectName" = "<your-project-name>" }

1. Run a Codex session after updating config.toml.
2. Confirm OTLP HTTP requests are sent to /otel/v1/traces.
3. Verify traces appear in the expected Opik workspace/project. Expect many short internal traces per session (auth, turn/start, codex.exec, ...); open a session_loop or dispatch_tool_call_with_terminal_outcome span and look under Metadata → opentelemetry.events for the codex.* events.

• Codex telemetry export is opt-in.
• Prompt text and token usage are only available on the logs signal (otel.exporter), which Opik does not receive.
• Keep log_user_prompt = false unless your policy explicitly allows prompt text export.
• If your Codex build uses a different exporter key path, align with your installed version's config reference.

• Codex security and OTEL opt-in
• Codex config basics
• Codex config reference
• Opik OpenTelemetry overview