Authentication
nod uses one provider at a time, and both providers are subscriptions you already have: a ChatGPT plan through the Codex backend, or a Grok plan. There are no API keys and nothing is billed per token.
Keep credentials out of project config
Use
nod loginfor local credentials. nod has no API-key mode, so there is nothing to put in CI secrets or in.nod.json; a headless machine signs in once withNOD_NO_OPEN_BROWSER=1and reuses the saved session.
Model providers
| Provider | Requires | Sign in |
|---|---|---|
| Codex | A ChatGPT Plus, Pro, Business, Enterprise, or Edu subscription | nod login codex |
| Grok | A SuperGrok or X Premium subscription | nod login grok |
Switch providers with nod provider, or open /provider inside nod. /login opens the same provider picker:
nod provider codex
Switching to a provider signs you in
Selecting Codex or Grok starts browser sign-in if no saved session is available for that provider.
A credential authorizes only its own provider. A Codex session cannot serve Grok and a Grok session cannot serve Codex, so the provider you select decides which saved session nod looks for.
Each provider carries its own model catalog, and /models and nod models list the models of the active provider. The catalog depends on the plan behind the subscription.
Sign in
Sign in with ChatGPT:
nod login codex
Sign in with Grok:
nod login grok
nod login opens the provider's authorization flow in your browser. The OAuth session is saved in ~/.nod/codex-auth.json or ~/.nod/grok-auth.json, readable only by your user, and refreshed when needed. Signing in also makes that provider active, so signing in and switching are the same step. Without a provider argument, nod login opens the provider picker.
In a headless environment, set NOD_NO_OPEN_BROWSER=1 before nod login to print the authorization URL instead of trying to open it.
Sign-in uses the OAuth clients of OpenAI's Codex CLI and xAI's Grok CLI against their subscription backends. These are not public APIs and can change without notice. You are responsible for following each provider's terms.
Provider selection
The active provider is resolved in this order:
NOD_PROVIDER, set for the current processproviderin~/.nod/settings.json, written bynod loginandnod providercodex
If the selected provider has no usable saved session, nod does not fall back to the other one. Sign in, or choose the other provider explicitly. Run /status to inspect the active provider and model_source.
Inspect or remove credentials
Run nod status to inspect the active provider and model, permission mode, workspace, and update channel. It also reports model_source and connected_providers:
nod status
Sign out of a provider:
nod logout grok
nod logout grok removes the saved session and revokes its token with xAI. nod logout codex removes the session from this machine only. To withdraw nod's access to a ChatGPT account, remove it from the connected applications in that account. Without a provider argument, nod logout signs out of the active provider.