Sign in with ChatGPT vs Codex login: choose by app, not label

Choose Sign in with ChatGPT for app-specific authorization when your app offers it, or the app's supported Codex login when you need that route's capabilities. Neither gives you a second allowance. An OpenAI API key is a different payer, not a substitute name for your ChatGPT subscription.

The confusing part is that the same label has different contexts: native Codex calls its subscription login “Sign in with ChatGPT,” while some other apps offer that label alongside a separate Codex method. This comparison checks OpenCode, OpenClaw and Hermes documentation on 14 November 2026. It is a documented decision guide, not a hands-on account migration or security certification.

What does each login label actually mean?

OpenAI's authentication guide distinguishes subscription sign-in from API-key access. Its third-party app guide describes apps requesting account identity and eligible plan use. Do not infer permission to run models from identity sign-in alone.

Surface	Choice documented by its maker	What to verify before using it
Native Codex	Sign in with ChatGPT or API key	Subscription account versus Platform billing
OpenCode	Sign in with ChatGPT or legacy Codex methods	Exact method selected, then available model
OpenClaw	Sign in with ChatGPT Beta, Codex browser/device login, or API key	App grant, model access and required tools
Hermes Agent	ChatGPT or Codex Subscription provider	Its documented device-code or browser flow, not another app's menu

“Legacy” in OpenCode's menu is not evidence that OpenAI has announced the method's termination. Nor does seeing a login button prove that every plan, workspace or model is eligible. Read the consent screen for the account you intend to use. Browse the ChatGPT app hub for discovery; use current maker instructions for authorization.

Which method should you choose in each app?

In OpenCode, the current provider instructions say to connect OpenAI through /connect, choose Sign in with ChatGPT or a legacy Codex method, then select a model through /models. The maker describes Plus or Pro plan usage and says these models show no cost in OpenCode. That display is not unlimited usage or a bill audit. Our OpenCode setup article covers the broader installation workflow.

In OpenClaw, use its authentication comparison to pick between app-specific SIWC authorization and Codex access. Both draw on the Codex allowance. Its own agent runtime and the native Codex harness are separate choices from authentication. A login called Codex does not, by itself, tell you which runtime executes the tools.

In Hermes, the provider reference documents hermes model → ChatGPT or Codex Subscription. It defaults to device-code authorization and offers hermes auth add openai-codex --browser for browser authorization. It does not establish that Hermes has the same two-route menu as OpenCode. The reference also leaves detailed Codex plan-tier and quota semantics undocumented; verify eligibility rather than extending another app's promise.

Does a working model login authorize images and connected apps?

No. OpenClaw separates model access from tool credentials. Its current documentation says SIWC does not support its image_generate tool, audio transcription or OpenAI-hosted plugins through Codex. Other configured providers can supply some capabilities, which introduces another funding route.

Codex login is not a blanket plugin permission either. OpenClaw says neither its device-code login nor its browser flow grants the connector scope required for OpenAI-hosted plugins. Native Codex plugin setup needs a qualifying grant and may still need the external account and workspace permission. Local OpenClaw plugins have their own permissions.

Before switching, list the actual jobs you rely on: text replies, image generation, speech and connected services. Mark each as required or optional, then check it against the installed version's documented capability table. A successful text reply is not proof that the whole workflow survived migration. Review auxiliary and fallback billing before enabling scheduled work.

Which account changes when you reconnect?

OpenClaw distinguishes an agent's shared credential from a personal account on a Gateway. Its maker says personal defaults apply to new chats; existing chats retain their selected account. Check the Gateway, person and scope before approving a connection, then inspect the conversation's model/account selector and /status.

For any app, our suggested migration record is simple: app version, runtime, selected account, authorization method, model and required tools. Record only labels and redacted identifiers. Never put tokens or authorization codes into an issue, screenshot or shared note. Leave the old working configuration available until you have checked a harmless task in the new one, unless revocation is necessary for security.

What should you check before calling the switch complete?

Use a small acceptance checklist rather than treating the login success page as completion:

1. Confirm the intended personal or work account and workspace.
2. Confirm model-use permission, not identity permission alone.
3. Verify the selected model in a fresh conversation.
4. Check required tools separately and identify their payer.
5. Review usage in the provider's account surface and inspect configured fallbacks.

These are proposed checks for your installation, not tests we ran against an authenticated account. If access fails, follow the login diagnosis guide rather than repeatedly reconnecting or pasting credentials elsewhere. Keep allowance questions separate from authentication: the per-app usage guide covers caps and shared capacity. A different login method can change permissions without changing how much plan usage you own.