Codex with NexKit
Codex talks to NexKit over /v1/responses — the OpenAI Responses surface. This is the configuration the P5 and P7 smoke tests run against a real provider.
Before you start
- Codex installed and on your
PATH. - A NexKit API key.
- A connected provider — DeepSeek or Qwen.
Create a NexKit API key
Sign in, open the dashboard, and create a key on the API Keys step. It looks like nk_live_….
It is shown exactly once. The gateway stores a SHA-256 hash and a short display prefix, so it cannot be shown again and cannot be recovered. Copy it before you leave the page; if you lose it, revoke it and create another.
Connect a provider
A NexKit key on its own reaches nothing. NexKit does not sell tokens — you bring your own provider credential, and that provider bills you directly.
- DeepSeek — Starts with sk- Get a key
- Alibaba Model Studio (Qwen) — Starts with sk-. Regions are separate accounts — use the key for your region. Get a key
Paste it on the Providers step of the dashboard. It is encrypted before it is stored and you will only ever see the last four characters.
Configure Codex
Choose the provider you connected — the model id changes, nothing else does.
Put this in ~/.codex/config.toml:
model = "deepseek-v4-flash"
model_provider = "nexkit"
[model_providers.nexkit]
name = "NexKit"
base_url = "https://api.nexkit.uk/v1"
env_key = "NEXKIT_API_KEY"
wire_api = "responses"
requires_openai_auth = falsewire_api and requires_openai_auth are not optional. Without wire_api = "responses" Codex uses /v1/chat/completions instead — a different surface. Without requires_openai_auth = false it expects an OpenAI login and ignores your key.
Then put your key in the variable the config names:
export NEXKIT_API_KEY="nk_live_YOUR_KEY"Any of deepseek-v4-flash, deepseek-v4-pro works as the model.
Test it
codex exec "Reply with exactly this word and nothing else: NEXKIT"What success looks like
Codex prints NEXKIT and exits 0. That is a full round trip: Codex → /v1/responses → the translation → your provider key → the model.
Once a request lands, it is counted in Usage and journalled in Logs — as counts, timings and a request id. Neither can show you the text, because the text is never stored.
Common errors
| What you see | What it means | What to do |
|---|---|---|
401 · invalid_api_key | The NexKit key is wrong, revoked, or not being sent. | Check the key is the one you copied at mint time — it is shown once and cannot be shown again. If you lost it, revoke it and create another. |
412 · byok_missing | The key is valid, but this account has no credential attached for the provider that owns the model you named. | Connect DeepSeek or Qwen on the Providers screen, then try again. |
404 · model_not_found | The model id does not exist, or is retired. `deepseek-chat` and `deepseek-reasoner` were disabled upstream and never resolve. | The error names what is available. Or run the models check above to list exactly what your key can reach. |
200, but the model list is empty | A valid key with no provider credential attached. This is a correct answer, not a fault. | Attach a provider credential. A key alone reaches nothing — NexKit never fronts the tokens. |
404 on every request, path looks doubled | `ANTHROPIC_BASE_URL` was set with a `/v1` suffix. Claude Code appends its own path, so the request goes to `/v1/v1/messages`. | Set the base URL with no path at all. |
Codex ignores the key, or asks you to log in | `wire_api` or `requires_openai_auth` is missing from the provider block. | Both lines are in the config above. Without them Codex uses the wrong surface, or expects an OpenAI login instead of your key. |
What NexKit stores, and what it does not
- Your `nk_live_*` key is shown exactly once, at the moment it is created. The gateway keeps a SHA-256 hash and a 12-character display prefix, so it cannot be shown again and cannot be recovered — a lost key is revoked and replaced.
- Your provider key is encrypted with AES-256-GCM before it is stored and is decrypted only at the moment a request is made. There is no endpoint anywhere that can read one back. You will only ever see the last four characters.
- No prompt and no output is ever stored. Requests are recorded as counts, timings and identifiers only — that is what Usage and Logs are built from, and it is why neither can show you the text of a request.
- Your provider bills you directly, on your own account. NexKit never fronts the tokens, so there is no NexKit invoice and no card on file.