The administrator deploys the gateway on a Linux PC, connects it to LinkAI ModelHub, then gives employees the LAN gateway base_url and LinkAI Local API Keys.
Choose one Linux PC as the enterprise local gateway. Employee computers and this Linux PC must stay on the same LAN, and the Linux PC needs outbound access to LinkAI ModelHub.
http://linux-ip:18080/v1https://api.linknlink.ai/modelhub/v1hostname -IIf you are not sure which package to use, first check your Linux distribution and architecture. Debian or Ubuntu uses DEB; RHEL, CentOS, Rocky Linux, or compatible systems use RPM. x86_64 or amd64 uses x86; aarch64 or arm64 uses arm64.
uname -mwget -O apiproxy_latest_amd64.deb https://oss.linknlink.vip/homeclaw/apiproxy_latest_amd64.debwget -O apiproxy_latest_arm64.deb https://oss.linknlink.vip/homeclaw/apiproxy_latest_arm64.debwget -O apiproxy-latest.x86_64.rpm https://oss.linknlink.vip/homeclaw/apiproxy-latest.x86_64.rpmwget -O apiproxy-latest.aarch64.rpm https://oss.linknlink.vip/homeclaw/apiproxy-latest.aarch64.rpmChoose the commands that match your package format. For arm64, replace the package filename in the first command with the arm64 or aarch64 filename you downloaded.
sudo dpkg -i apiproxy_latest_amd64.deb
sudo systemctl daemon-reload
sudo systemctl restart apiproxy
sudo systemctl enable apiproxy
sudo systemctl status apiproxy --no-pagersudo rpm -Uvh apiproxy-latest.x86_64.rpm
sudo systemctl daemon-reload
sudo systemctl restart apiproxy
sudo systemctl enable apiproxy
sudo systemctl status apiproxy --no-pagerIf the status is active, the gateway service is running. Keep this Linux PC powered on while employees use the local gateway.
Open the gateway console in a browser, usually http://linux-ip:18080. Sign in with the initial username admin and password admin, then change the administrator password and keep the new password in a safe place.
In the gateway console, fill in the upstream LinkAI ModelHub API Key, Base URL, and default model. The LinkAI API Key comes from the LinkAI platform and is the main key used by the gateway to call ModelHub. This upstream key stays on the Linux PC and does not need to be given to employees.
If you do not have a LinkAI API Key yet, sign in to LinknLink AI, create an API Key, and copy the value that starts with sk-. If you already have a valid LinkAI API Key, you can use it directly.
https://api.linknlink.ai/modelhub/v1gpt-5.6-solLinkAI API Key
Open Local API Key in the gateway console. Enter a clear name such as Cursor-Zhang San, fill in the owner user or device, and leave allowed models empty if you do not need to restrict models. Click Create Key, then copy the generated sk-loc key for the employee.
Cursor-Zhang SanEmpty means unlimitedsk-loc... and http://linux-ip:18080/v1
Finally, give employees only two pieces of information: the local sk-loc key and the LAN base_url, for example http://linux-ip:18080/v1. Do not distribute the upstream LinkAI API Key configured on the Linux gateway PC.
Install Codex, enter the local API Key and LAN gateway base_url, then write the Codex provider configuration.
Linux uses Codex CLI. Open Terminal first, then copy and run this command.
npm install -g @openai/codex@latestUse the LinkAI Local API Key assigned by your enterprise gateway administrator. Then enter the LAN gateway address, for example http://local-ip:18080/v1.
Paste a key that starts with sk-. If valid, the commands below update automatically. The key is not saved.
API Key should start with sk-. The commands below still use the placeholder.
Enter the enterprise local gateway address provided by your administrator. The config and debug commands below update automatically.
Keep the key private. Current values: API Key sk-replace-with-your-LinkAI-key, base_url http://local-ip:18080/v1.
Open Terminal first: press Command + Space, search Terminal, and press Enter. Then write the key to ~/.zshrc. For the Codex desktop app or VS Code launched from Finder, also write the macOS GUI environment variable.
echo 'export OPENAI_API_KEY="sk-replace-with-your-LinkAI-key"' >> ~/.zshrc
source ~/.zshrc
launchctl setenv OPENAI_API_KEY "sk-replace-with-your-LinkAI-key"You can copy and run this command directly. It backs up the current config first, then writes a minimal LinkAI config.
mkdir -p ~/.codex/backups
cp ~/.codex/config.toml ~/.codex/backups/config.toml.before-linkai.$(date +%Y%m%d%H%M%S) 2>/dev/null || true
cat > ~/.codex/config.toml <<'EOF'
model = "gpt-5.6-sol"
model_provider = "linkai"
[model_providers.linkai]
name = "LinkAI"
base_url = "http://local-ip:18080/v1"
env_key = "OPENAI_API_KEY"
wire_api = "responses"
requires_openai_auth = false
EOFNew users can copy and run this command directly. If you already use MCP, plugins, or project trust settings in Codex, keep your existing file and manually add or update only model, model_provider, and the [model_providers.linkai] block shown above.
Fully quit Codex before reopening it. On macOS, use Codex > Quit Codex, and check Activity Monitor if needed. If it still opens the login page, restart the computer, then open Codex and send reply only ok.
Open Terminal first from your application menu or with Ctrl + Alt + T if your desktop supports it. The command below makes the key available in the current terminal and writes it to ~/.bashrc.
export OPENAI_API_KEY="sk-replace-with-your-LinkAI-key"
echo 'export OPENAI_API_KEY="sk-replace-with-your-LinkAI-key"' >> ~/.bashrc
source ~/.bashrcYou can copy and run this command directly. It backs up the current config first, then writes a minimal LinkAI config.
mkdir -p ~/.codex/backups
cp ~/.codex/config.toml ~/.codex/backups/config.toml.before-linkai.$(date +%Y%m%d%H%M%S) 2>/dev/null || true
cat > ~/.codex/config.toml <<'EOF'
model = "gpt-5.6-sol"
model_provider = "linkai"
[model_providers.linkai]
name = "LinkAI"
base_url = "http://local-ip:18080/v1"
env_key = "OPENAI_API_KEY"
wire_api = "responses"
requires_openai_auth = false
EOFNew users can copy and run this command directly. If you already use MCP, plugins, or project trust settings in Codex, keep your existing file and manually add or update only model, model_provider, and the [model_providers.linkai] block shown above.
Open a new terminal and verify the connection.
codex exec --skip-git-repo-check -m gpt-5.6-sol 'reply only ok'Open Windows PowerShell first, then copy and run this command.
$env:OPENAI_API_KEY = "sk-replace-with-your-LinkAI-key"
[System.Environment]::SetEnvironmentVariable("OPENAI_API_KEY", "sk-replace-with-your-LinkAI-key", "User")You can copy and run this command directly. It backs up the current config first, then writes a minimal LinkAI config.
$codexDir = Join-Path $HOME ".codex"
$backupDir = Join-Path $codexDir "backups"
$configPath = Join-Path $codexDir "config.toml"
New-Item -ItemType Directory -Force $backupDir | Out-Null
if (Test-Path $configPath) {
Copy-Item $configPath (Join-Path $backupDir "config.toml.before-linkai.$(Get-Date -Format yyyyMMddHHmmss)") -ErrorAction SilentlyContinue
}
$config = @"
model = "gpt-5.6-sol"
model_provider = "linkai"
[model_providers.linkai]
name = "LinkAI"
base_url = "http://local-ip:18080/v1"
env_key = "OPENAI_API_KEY"
wire_api = "responses"
requires_openai_auth = false
"@
[System.IO.File]::WriteAllText($configPath, $config, [System.Text.UTF8Encoding]::new($false))New users can copy and run this command directly. If you already use MCP, plugins, or project trust settings in Codex, keep your existing file and manually add or update only model, model_provider, and the [model_providers.linkai] block shown above.
Fully quit Codex before reopening it. On Windows, closing the window may not exit the app: check the bottom-right system tray and Task Manager, and quit any remaining Codex process. If it still opens the login page, restart the computer, then open Codex and send reply only ok.
Send a Responses API request to the enterprise local gateway and view the result.
Get a LinkAI API Key, enter the LAN gateway base_url, then enter the prompt you want to send. The key is only used in this browser tab and is not saved.
API Key should start with sk-.
Open Terminal and copy this command. In PowerShell, use curl.exe if curl is treated as an alias.
curl -X POST 'http://local-ip:18080/v1/responses' \
-H 'Content-Type: application/json' \
-H 'x-api-key: sk-replace-with-your-LinkAI-key' \
--data-raw '{"model":"gpt-5.6-sol","input":[{"role":"user","content":[{"type":"input_text","text":"reply only ok"}]}],"stream":false}'The browser request is sent to the same gateway endpoint as the curl command. After it runs, the full response appears below.
No result yet.Use this when an employee stops using the enterprise local gateway or wants to return Codex to the official ChatGPT / Codex login flow.
osascript -e 'quit app "Codex"' 2>/dev/null || true
pkill -x Codex 2>/dev/null || true
mkdir -p ~/.codex/backups
cp ~/.codex/config.toml ~/.codex/backups/config.toml.before-restore-official.$(date +%Y%m%d%H%M%S)cat > ~/.codex/config.toml <<'EOF'
# Official Codex uses your ChatGPT / Codex account.
# Leave this file without a LinkAI model_provider block.
EOF
launchctl unsetenv OPENAI_API_KEYIf the original config includes MCP, plugins, or project trust settings, do not overwrite the entire file. Manually remove model_provider = "linkai" and the [model_providers.linkai] block.
mkdir -p ~/.codex/backups
cp ~/.codex/config.toml ~/.codex/backups/config.toml.before-restore-official.$(date +%Y%m%d%H%M%S)
cat > ~/.codex/config.toml <<'EOF'
# Official Codex uses your ChatGPT / Codex account.
# Leave this file without a LinkAI model_provider block.
EOFIf you keep custom MCP, plugins, or project trust settings, do not overwrite the entire file. Manually remove model_provider = "linkai" and the [model_providers.linkai] block.
New-Item -ItemType Directory -Force "$env:USERPROFILE\.codex\backups" | Out-Null
Copy-Item "$env:USERPROFILE\.codex\config.toml" "$env:USERPROFILE\.codex\backups\config.toml.before-restore-official.$(Get-Date -Format yyyyMMddHHmmss)"
@'
# Official Codex uses your ChatGPT / Codex account.
# Leave this file without a LinkAI model_provider block.
'@ | Set-Content -Encoding UTF8 "$env:USERPROFILE\.codex\config.toml"
[Environment]::SetEnvironmentVariable("OPENAI_API_KEY", $null, "User")If you keep custom MCP, plugins, or project trust settings, do not overwrite the entire file. Manually remove model_provider = "linkai" and the [model_providers.linkai] block.
Common checks for employee Codex configuration through the enterprise local gateway.
Employees should use the LinkAI Local API Key assigned by the enterprise gateway administrator. Do not distribute the upstream LinkAI API Key used by the Linux gateway PC.
Use the LAN gateway address provided by the administrator, usually similar to http://local-ip:18080/v1. Do not use the public ModelHub endpoint in employee configurations.
On macOS, desktop apps may not read ~/.zshrc. Run launchctl setenv OPENAI_API_KEY "sk-...", confirm with launchctl getenv OPENAI_API_KEY, then fully quit and reopen Codex.
Yes. Install the Codex desktop app and verify Codex CLI first, then install the official ChatGPT / Codex extension in VS Code. If VS Code returns 401 while CLI works, fully quit and reopen VS Code.
The minimal config commands replace config.toml after creating a backup. If Codex already has MCP, plugins, or project trust settings, manually merge the LinkAI provider block instead.
Use the API Debug tab with the same local key and base_url. If browser debugging fails because of network policy, copy the generated curl command and run it in Terminal or PowerShell.
Install Claude Code, then connect it to the enterprise LAN gateway with the local API Key from your administrator.
Claude Code is available as a desktop app. Download and install it for macOS from the official site.
Use the LinkAI Local API Key assigned by your enterprise gateway administrator, together with the LAN gateway address, for example http://192.168.x.x:18080/v1. Do not use the public ModelHub endpoint.
Claude Guard routes only Claude requests through a local gateway to the enterprise LAN gateway, without changing your browser traffic or macOS system proxy. Choose Apple silicon for an M-series Mac, or Intel for a Mac with an Intel processor.
Open Claude Guard and go to the Gateway tab, then click Configure ModelHub. Choose LAN mode to connect through the enterprise local gateway on the same LAN, enter the LAN gateway address and the Local API Key assigned by your administrator, and click Save.
LAN modehttp://192.168.x.x:18080/v1sk-local-...
Claude requires access from a supported region. Set your system timezone to a non-China country, then turn on your VPN so the exit IP is also in a non-China country.
Back on the Gateway tab, click Start protection. Only Claude requests will use the local gateway.
Open the Status tab and confirm that every item under Environment and connection is green, including timezone, exit IP, outbound proxy, gateway forwarding, security check, and Claude configuration.
In Claude Guard, click Restart Claude. Then open the Claude Code desktop app and start a conversation to verify the connection.
Claude Code is available as a desktop app. Download and install it for Windows from the official site.
Use the LinkAI Local API Key assigned by your enterprise gateway administrator, together with the LAN gateway address, for example http://192.168.x.x:18080/v1. Do not use the public ModelHub endpoint.
Claude Guard routes only Claude requests through a local gateway to the enterprise LAN gateway, without changing your browser traffic or Windows system proxy. Download and install Claude Guard for Windows.
After installation, open LinknLink Claude Guard and stay on the Status tab. In LAN mode, you do not need to configure a LinkAI platform API Key; use the local connection details supplied by your administrator in step 6.
Use a non-China system timezone and make sure the public exit IP is outside both mainland China and Hong Kong. After changing the environment, click Refresh and continue when the top of the page shows Access conditions met.
Under Connection information, click Connection settings. Select LAN mode, enter the LAN gateway Base URL and LinkAI Local API Key supplied by your administrator, then click Save.
LAN modehttp://192.168.x.x:18080/v1sk-local-...
Click Start forwarding. Claude Guard may perform a security check first; no action is required while it completes. Continue when WebSocket heartbeat shows Connected · Healthy.
If Claude Desktop is not running, click Start. If it is already running, click Restart. When the status changes to Running, open Claude Desktop and start a conversation to verify the connection.
