| provider | Model provider: auto, openai, cloudflare, or opencode. | no | auto |
| openai-api-key | OpenAI API key. Prefer this input over env passthrough so the key is isolated by openai/codex-action. | no | — |
| cloudflare-api-key | Cloudflare API token with AI Gateway permission. Prefer this input over env passthrough. | no | — |
| cloudflare-account-id | Cloudflare account ID. Prefer this input over env passthrough. | no | — |
| cloudflare-ai-gateway-id | Cloudflare AI Gateway ID or slug. Defaults to default. Prefer this input over env passthrough. | no | — |
| opencode-api-key | OpenCode Zen API key. Prefer this input over env passthrough so the key is isolated by openai/codex-action. | no | — |
| model | OpenAI-compatible Codex Responses model to use. | no | gpt-5.5 |
| commands | Comma-separated slash commands that trigger Codex. | no | /codex,/review |
| prompt_file | Repository path to extra prompt instructions injected into every Codex run. Read from the PR base/default branch. | no | — |
| required-permission | Minimum repository permission required to run: write, maintain, or admin. | no | write |
| allow-forks | Run on fork PRs in read-only mode. Defaults to false to avoid exposing secrets to fork code. | no | false |
| create-pr | Allow standalone issue comments to create pull requests. | no | true |
| push-pr-branch | Allow same-repository PR comments to push commits to the PR branch. | no | true |
| commit-message | Commit message used when Codex publishes changes. | no | apply codex changes |
| branch-prefix | Branch prefix for PRs created from standalone issues. | no | codex |
| blocked-paths | Extra newline- or comma-separated glob patterns that Codex may not modify. | no | — |
| codex-version | Optional Codex CLI version passed to openai/codex-action. | no | — |
| codex-args | Extra arguments passed to codex exec by openai/codex-action. | no | — |
| effort | Optional reasoning effort passed to openai/codex-action. | no | — |
| safety-strategy | Privilege reduction strategy passed to openai/codex-action. | no | drop-sudo |
| github-token | GitHub token used for API calls, comments, pushes, and PR creation. | no | — |