Safeguard
Developer Tools•

How do Codex usage limits work on ChatGPT plans?

Codex usage on ChatGPT plans is counted per five-hour window plus weekly limits, shared by local and cloud tasks. How credits and API keys fit in.

Safeguard Security Team
8 min read

Codex usage on a ChatGPT plan is measured against your plan's allowance, with limits counted per five-hour period on some plans and weekly limits that may also apply. Local messages and cloud chats share one allowance, and similar-looking tasks can use different amounts. Credits or an API key let you continue past the included amount.

What the documentation says

OpenAI's Codex pricing and usage page describes limits in terms of local messages per five-hour period on Plus and standard Business plans, with weekly limits that may also apply. It says Pro plans currently have no five-hour limit. It points to a usage dashboard and a status command in the terminal tool for your current limits and reset times, so those are the places to look rather than a blog post.

The page also says local messages and cloud chats share your plan's allowance, and that cloud tasks may use more of the allowance than local messages. Two more details matter for planning. First, tasks that look similar can consume different amounts, because model choice, task size, reasoning, tool use, retrieval and caching all play a part, so prompt length alone is a poor estimate. Second, the page lists modes and features that draw on limits faster than a plain turn, including image generation and faster processing modes.

The page gives estimated message counts per model for a five-hour period and labels them estimates, not fixed limits. This post does not repeat them, because they change and depend on the model.

The pieces, side by side

PieceWhat the page says
WindowLocal messages per five-hour period on some plans, with weekly limits that may apply
Pro plansNo five-hour limit at the time of review
Local versus cloudShare one allowance; cloud may use more
VariationSimilar tasks can use different amounts
CreditsLet you keep working after included limits
API keyExtra local chats at standard API rates, for the CLI, SDK or IDE extension, not cloud features
Enterprise and EduWith flexible pricing, no fixed rate limits and usage scales with credits

Worked example: a week of use

This example is illustrative. A developer uses Codex locally for small edits on Monday and Tuesday, then starts a large refactor on Wednesday using a more capable model with higher reasoning, and kicks off several cloud tasks in parallel.

Monday and Tuesday are well inside the allowance. On Wednesday, the model choice, reasoning level and cloud tasks all push consumption up. The developer sees a warning, checks the usage dashboard, and finds the five-hour window nearly used. The options on the page are to wait for the reset, buy credits, or use an API key for extra local work. The developer chooses to wait for one window, then switches routine edits to a smaller model for the rest of the week.

How to stretch an allowance

  1. Match the model and reasoning level to the task. Reserve the heavy settings for hard problems.
  2. Prefer local runs for small edits if cloud tasks use more.
  3. Avoid features that draw faster unless the task needs them.
  4. Keep sessions focused. Larger projects and longer sessions use more, per the page.
  5. Check the usage dashboard before a big job, not after.

Plan or API key for team work

For a team, a plan gives each person an allowance. An API key gives usage billed per token at standard API rates and ties to your organization's API controls, such as spend limits. The page notes that API-key plans cover Codex in the CLI, SDK or IDE extension but not cloud features such as code review integrations. If you need cloud features, a plan is the route. If you need centralized limits and attribution, the API path fits. Our post on how API limits and spend caps work covers the controls on that side.

A governance note

A coding agent that can edit files and run commands is an identity with reach into your code. Decide which accounts may use it on company repositories, review its permissions, and log what it changes. The CLI page describes a permissions command that controls when Codex may edit files or run commands without asking. Treat that like any least privilege setting, and see token permissions for AI agents.

Choosing a plan type by workload shape

Different working patterns map to different options. These are decision heuristics, not guarantees, so check the page for current plan features.

Your patternLikely fitWhat to verify
Occasional edits, one developerAn individual planWhether the five-hour window covers a typical day
Heavy daily use by one developerA higher individual plan, or creditsWhich plans currently have a five-hour limit
Team with admin and attribution needsA business plan or API keyAdmin controls and credit options
CI or scripted runsAPI keyThat the page lists your surface as covered by API-key use
Large organization with spend scalingFlexible pricingWhether fixed rate limits apply

The CLI page also says you can call the tool from scripts and CI pipelines. For automation, plan around the account type that the run uses, because an unattended job that stops at a limit fails quietly.

A checklist before a big task

  1. Open the usage dashboard or run the status command and note remaining allowance and reset time.
  2. Pick the model and reasoning level for the task, and write down why.
  3. Decide whether local or cloud execution is needed, since cloud may use more.
  4. Break the task into steps that can finish within a window.
  5. Decide what you will do if the limit arrives mid task: wait, credits or API key.
  6. Afterward, check the dashboard again and note how much the task used, so next time you can plan.

What not to assume

Do not assume the same task uses the same allowance every time. The page says similar tasks can differ. Do not assume prompt length predicts usage. Do not assume a limit that applied last month still applies, since the page uses words like "currently" about plan features. And do not assume API-key use covers every feature, because the page says cloud features are not included.

Questions to ask your admin

If your company manages the plan, ask which plan type you are on, whether credits can be purchased and by whom, whether API-key use is permitted for local work and who pays for it, and which models are enabled. Ask also where usage reports live and how often someone reviews them. Many limit frustrations come from not knowing which of these options exist, and one short conversation can clear them.

What this means for you

If you use Codex on a plan, your allowance depends on what you ask it to do, not only how often. A small local edit and a large cloud task are different amounts. Check your usage view before big jobs and match the model and reasoning level to the task.

Common mistakes

Typical errors are assuming similar tasks cost the same, picking the heaviest setting for routine work, running everything in the cloud when a local run would do, ignoring weekly limits while watching the five-hour window and expecting an API key to cover cloud features. Check the dashboard, plan the week, and know your fallback before a limit arrives.

Try it yourself

Click through it at your own pace, or open it full screen. It shows ChatGPT working alongside Safeguard. Watch how the assistant's answers are grounded in your project data, which is the kind of setup where knowing your allowance and permissions matters.

Safeguard offers reachability analysis, SBOM and dependency scanning, and policy gates for the code an agent writes, and a free scan is at gold.safeguard.sh/scan.

Quick check

Do local and cloud Codex tasks have separate allowances?

No. The page says local messages and cloud chats share your plan's allowance, and cloud tasks may use more of it.

Can prompt length tell me how much a task will use?

Not reliably. The page says model choice, task size, reasoning, tool use, retrieval and caching all matter, so similar tasks can differ.

What can I do after hitting the included limit?

The page lists credits for continued work and an API key for extra local chats at standard API rates. Waiting for the reset is the other option.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.