Stop Codex saving conversation history to disk: history.persistence and where credentials are stored
Keep Codex CLI from writing conversation history with history.persistence = "none", cap it with max_bytes, and choose where login credentials live with cli_auth_credentials_store.
On a shared machine or a throwaway test environment, two requirements come up: do not leave conversation contents on disk, and do not write login credentials to a file. Codex CLI has a setting for each.
In short: persistence = "none" under [history] stops history being saved, max_bytes caps it, and cli_auth_credentials_store picks file, keyring, or ephemeral for credentials.
KEY POINT
What you will learn
- The two
history.persistencevalues, the default, and howmax_bytesbehaves - The four values of
cli_auth_credentials_store - What you give up when you choose not to persist
Turning off history
In ~/.codex/config.toml:
[history]
persistence = "none"| Key | Values | Default | Meaning |
|---|---|---|---|
persistence | save-all / none | save-all | none saves no history |
max_bytes | bytes | unset | over the limit, drop the oldest entries and compact the file |
To limit size rather than disable, use max_bytes. The sample configuration shows 5242880 (5 MiB) as a commented example.
[history]
persistence = "save-all"
max_bytes = 104857600 # 100 MiBWhen the file exceeds the cap, Codex drops the oldest entries and keeps recent records.
用語解説
History: the local data Codex keeps so past conversations can be reviewed or resumed. With persistence = "none", new conversations are not recorded, so features that recall earlier sessions have nothing to work with.
Where credentials are stored
cli_auth_credentials_store decides where the credentials from a ChatGPT or API-key login are kept.
cli_auth_credentials_store = "keyring"| Value | Location |
|---|---|
auto (default) | chosen automatically for the environment |
file | a file under $CODEX_HOME |
keyring | the OS keychain or secret store |
ephemeral | in process only; gone when Codex exits |
On a shared machine, keyring protects credentials per OS account; in disposable environments such as CI, ephemeral leaves nothing behind. MCP server OAuth credentials have their own key, mcp_oauth_credentials_store (auto / file / keyring).
Not persisting means no resume and no auto-login
With persistence = "none" you cannot resume past conversations, and with ephemeral you log in on every launch. Both are trade-offs against convenience, so reserve them for shared machines and test environments where they are really needed.
Not the same as telemetry
History persistence is about what stays on the local disk; whether data is sent to OpenAI is governed by other keys.
| Key | Default | Meaning |
|---|---|---|
analytics.enabled | unset | enable or disable analytics |
feedback.enabled | true | allow feedback submission via /feedback |
otel.exporter | none | OpenTelemetry exporter (otlp-http / otlp-grpc) |
otel.log_user_prompt | unset | include raw user prompts in OTEL export |
How data is used for training is outside the scope of the config file reference used for this article and could not be confirmed here; check the data usage sections of the official Codex documentation.
The overall structure of the config file is covered in the hub article Configuring Codex with config.toml. Keeping secrets out of the commands Codex runs is covered in The shell_environment_policy setting.
Summary
[history] persistence = "none"stops history being written; the default issave-allmax_bytescaps the file, dropping the oldest entries firstcli_auth_credentials_storechoosesauto,file,keyring, orephemeralfor credentialsnoneandephemeralcost you resume and automatic login- Local persistence and data sent to OpenAI (analytics, feedback, otel) are separate keys
FAQ
- What is the default for history.persistence?
- save-all. Set it to none to stop saving history.
- Can I keep the history file from growing forever?
- Yes. Set history.max_bytes; when the file exceeds it, Codex drops the oldest entries and compacts the file.
- Can I avoid writing login credentials to a file?
- Set cli_auth_credentials_store to keyring for the OS keychain, or ephemeral to keep them in memory only. The default is auto.
Primary sources
This article was drafted by AI from official documentation and reviewed by the site operator before publishing. Found a mistake? Let us know via the contact page.