Codex CLI 0.164.0: A Simpler Bedrock Setup

Ethan Park

Quick housekeeping first: thanks to Jellypod for helping make this daily show a reality. Now, Codex CLI 0.164.0 shipped on October 23rd, and the change worth your time is that the Amazon Bedrock setup wizard is now enabled by default. If your team runs OpenAI models through Bedrock, this changes how you onboard people.

Maya

Here's the exact behavior. When Codex detects AWS credentials or an existing AWS configuration on the machine, the wizard now groups API key entry right next to the other AWS sign in methods. That means the Bedrock API key, which lives in the AWS_BEARER_TOKEN_BEDROCK variable, sits beside IAM profile credentials and IAM Identity Center sign in. The release notes list pull requests 56033 and 56023. Before this, you had to hand build a custom provider entry in your config.toml, or chain several config override flags on the command line.

Ethan Park

The reason that matters is drift. Plenty of teams want inference to stay inside their AWS perimeter, with their own cost allocation tags on the usage. Getting each developer there used to mean a specific TOML block, bearer token wiring, and an endpoint mapping, and every one of those is a place for two laptops to end up different. The wizard discovers what's already on the machine, so people start from detected profiles instead of from a copied snippet.

Maya

One piece of architecture is worth knowing, because it explains some gotchas later. Codex doesn't use Bedrock's classic runtime endpoint, the one behind InvokeModel and Converse. It talks to the newer Bedrock Mantle endpoint, at bedrock mantle, then your region, dot api dot aws, with the path slash openai slash v1 slash responses. Mantle serves OpenAI compatible Responses and Chat Completions APIs natively. So the models come through an API shape Codex already speaks.

Ethan Park

Now how to use it. Interactive path: start an unconfigured session, or enter provider setup, and you get a prompt with detected AWS profiles, or you can paste an API key directly. That's the whole workflow for a laptop.

Ethan Park

For CI runners, containers, and throwaway sandboxes, there's no wizard, so you use environment variables. Set AWS_REGION, for example us east 1, and set AWS_BEARER_TOKEN_BEDROCK to your key. Per the brief, Codex checks the bearer token first, and only then falls back to the standard AWS SDK credential chain: your credentials file, your AWS config, or instance metadata.

Maya

If you'd rather pin it in config, two settings in your user config.toml. First, model_provider set to the built in Bedrock provider, whose ID is amazon bedrock, with a hyphen between the two words. Second, under the table model_providers dot amazon bedrock dot aws, a region key set to us east 1, again spelled with hyphens. For a one off run, the same thing works as flags: codex exec, the skip git repo check flag if you're outside a repo, then c flags setting model_provider, the region key, and the model. The Sol model ID is openai dot gpt 5.6 sol, hyphenated as you'd expect. Add a prompt like hello and you have a smoke test.

Maya

Now the caveats, and the first one will cost somebody an afternoon. Model availability differs by region. Sol is available only in us east 1 and us east 2. Call it in us west 2 and you get an HTTP 404 saying the model does not exist. Terra and Luna are available in all three of those regions. So if you see a 404 after a clean setup, check the region before you touch your credentials.

Ethan Park

Related trap: discovery. If you run aws bedrock list foundation models, you won't see the GPT 5.6 models, because they live only on the Mantle endpoint. To verify regional access, probe the Mantle models path, slash v1 slash models, on that regional host using bearer token authentication, or check the model cards in the Bedrock console.

Maya

Third: token lifetime. Short term API keys generated in the Bedrock console cap at twelve hours, or when the browser console session ends. Fine for a demo, wrong for automation. For automated workflows, generate tokens dynamically with the AWS Bedrock token generator package, or use IAM roles. And whichever identity you use needs the AWS managed policy AmazonBedrockLimitedAccess. It covers both the runtime API and the Mantle bearer token calls, so a role scoped only to the classic API will fail here.

Ethan Park

Last caveat is budgeting. A one word hello prompt through Codex on Bedrock used 9,580 tokens in an example from an AWS community write up. Codex serializes its system instructions and tool definitions on every turn, roughly 9,400 to 9,500 tokens before your content. Put that into your rate limit and cost models, especially if you run many short exec calls.

Maya

A few smaller items from the same release. On Windows, HTTPS and WebSocket connections now answer proxy authentication challenges using the signed in user's Negotiate or NTLM identity, which targets corporate firewall failures. On macOS, the sandbox now handles case variant metadata paths and replaceable symlinks used to locate executables. Resuming a session whose history was compressed now finds that history and restores saved thread settings instead of falling back to global defaults. And the app server daemon prunes unused installs and bounds its log growth.

Ethan Park

One more, on the desktop app. A GitHub issue tracked bundled Node.js runtimes lagging behind the October 21st Node security release, version 24.22.1. One user on desktop build 26.1021.22027 reported both the primary and the Computer Use runtimes on 24.22.1. But other reports in that thread were mixed: one still saw the primary bundle on 24.19.0, and as of the last check we saw there was no maintainer confirmation in the issue. So check your own runtime versions rather than assume. That's the changelog for today.