Start here · about five minutes

Use AI through Guard.

Follow these steps in order. You will create one controlled identity, save its token safely, connect Codex, and send your first request.

You never need the shared Orbio key. Your personal Guard token starts with og_agent_. If you paste it into chat, a screenshot, or a public place, disable it and create another one.

Before you start

Get your personal agent.

Ask your operator

Tell them your project, model, daily budget, and request limit. If you are the operator, open the operator console.

Create the agent

For Codex, use allowed model openai/gpt-5.6-sol. A reasonable starting policy is $5/day and $0.50/request.

Copy the token once

After creation, Guard shows a value beginning with og_agent_. Keep that window open until the next step succeeds.

Open operator console

macOS

Save the token safely.

Copy this command exactly. Do not add the token to the command.

security add-generic-password -U \
  -a "$USER" \
  -s "orbio-guard-codex" \
  -w

What happens next

Terminal waits for a password. Paste the complete og_agent_... token, then press Return. The token may remain invisible while you paste. That is normal.

Now verify that Keychain has the item. This command does not print the token:

security find-generic-password \
  -a "$USER" \
  -s "orbio-guard-codex" \
  >/dev/null && echo "Guard token saved"

Expected outputGuard token saved

Do not type this security add-generic-password -U \og_agent_...

-U means “update if this item exists.” The token belongs at the hidden prompt after the command, not after -U.

Codex configuration

Point Codex at Guard.

Open the Codex configuration file:

mkdir -p ~/.codex
nano ~/.codex/config.toml

Add the following configuration. If the file already has top-level model or model_provider lines, replace those lines instead of adding duplicates.

model = "gpt-5.6-sol"
model_provider = "orbio_guard"

[model_providers.orbio_guard]
name = "Orbio Guard"
base_url = "https://api.guard.larkvine.org/v1"
env_key = "ORBIO_GUARD_AGENT_TOKEN"
env_key_instructions = "Use your Guard agent token, not the Orbio key."
wire_api = "responses"
requires_openai_auth = false
supports_websockets = false

Save in nano

Press Control+O, press Return to confirm the filename, then press Control+X.

Codex uses the metadata name gpt-5.6-sol. Guard safely maps it to Orbio's openai/gpt-5.6-sol model ID.

Every new terminal

Load the saved token.

Run this before starting Codex:

export ORBIO_GUARD_AGENT_TOKEN="$(
  security find-generic-password \
    -a "$USER" \
    -s "orbio-guard-codex" \
    -w
)"

Check that the variable exists without revealing it:

if [ -n "$ORBIO_GUARD_AGENT_TOKEN" ]; then
  echo "Guard token loaded"
else
  echo "Guard token missing"
fi

Expected outputGuard token loaded

Check before launch

Ask Codex Doctor.

codex --strict-config doctor --summary

Look at the bottom of the report.

Expected result22 ok · 0 warn · 0 fail

The Configuration section should show provider orbio_guard. If it shows openrouter, return to step 3 and replace the top-level provider setting.

Start working

Launch Codex normally.

codex

The Codex header should show:

Expected headermodel: gpt-5.6-sol

Now type a normal request, for example:

Review this project and explain how to run it.Find and fix the failing tests.

Codex sends your request to Guard. Guard checks your identity, model, status, request ceiling, and daily budget before using Orbio.

Optional terminal test

Test without Codex.

After loading the token in step 4, run:

curl https://api.guard.larkvine.org/v1/chat/completions \
  -H "Authorization: Bearer $ORBIO_GUARD_AGENT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-5.6-sol",
    "messages": [{"role": "user", "content": "Reply with: connected"}]
  }'

A JSON response containing "content":"connected" means the complete Guard and Orbio path works.

To see currently available Orbio models:

curl https://api.guard.larkvine.org/v1/models \
  -H "Authorization: Bearer $ORBIO_GUARD_AGENT_TOKEN"

Linux and Windows

Use a session variable.

Linux shell

This reads the token without displaying it, then exports it for the current terminal:

read -rsp "Paste Guard token: " ORBIO_GUARD_AGENT_TOKEN
echo
export ORBIO_GUARD_AGENT_TOKEN
codex

Windows PowerShell

For the current PowerShell window:

$secure = Read-Host "Paste Guard token" -AsSecureString
$pointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
$env:ORBIO_GUARD_AGENT_TOKEN = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($pointer)
codex

Apps and IDEs

Use the same token elsewhere.

JavaScript / TypeScript

OpenAI SDK

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.ORBIO_GUARD_AGENT_TOKEN,
  baseURL: "https://api.guard.larkvine.org/v1",
});

const result = await client.chat.completions.create({
  model: "openai/gpt-5.6-sol",
  messages: [{ role: "user", content: "Hello" }],
});

Python

OpenAI SDK

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["ORBIO_GUARD_AGENT_TOKEN"],
    base_url="https://api.guard.larkvine.org/v1",
)

result = client.chat.completions.create(
    model="openai/gpt-5.6-sol",
    messages=[{"role": "user", "content": "Hello"}],
)

Claude Code

Anthropic Messages

export ANTHROPIC_BASE_URL="https://api.guard.larkvine.org"
export ANTHROPIC_AUTH_TOKEN="$ORBIO_GUARD_AGENT_TOKEN"
export ANTHROPIC_MODEL="anthropic/claude-sonnet-5"
claude

VS Code / JetBrains

Integrated terminal

Open the project.
Open the IDE terminal.
Load the token using step 4.
Run codex, claude, or your app there.

Never commit a workspace file containing the token.

Cursor

Custom provider

Open Settings → Models.
Choose an OpenAI-compatible provider.
Base URL: https://api.guard.larkvine.org/v1
API key: your og_agent_... token.
Model: openai/gpt-5.6-sol

If your Cursor version has no base URL setting, use its terminal to run Codex or Claude Code.

Fix common mistakes

Read the error literally.

Keychain item not found: Step 2 did not finish. Run the save command again, wait for the hidden password prompt, paste the token, press Return, and run the verification command.
security command shows Usage: The command was malformed. Copy the step 2 command exactly. Do not place the token after -U.
Codex uses openrouter.ai: Your top-level model_provider is still openrouter. Replace it with orbio_guard in ~/.codex/config.toml.
Model metadata not found: Codex was given a provider-qualified model. Use gpt-5.6-sol in Codex config; Guard maps it to openai/gpt-5.6-sol.
401 INVALID_AGENT_TOKEN: The token is missing, mistyped, or invalid. Load it again. If it was exposed, disable that agent and create another.
403 MODEL_NOT_ALLOWED: The agent policy does not allow that model. Choose an allowed model or ask the operator to update the identity.
403 AGENT_PAUSED / AGENT_DISABLED: The operator stopped this identity. Contact the operator; do not bypass Guard.
429 limit or budget error: The request or daily allowance is exhausted. Ask the operator for an appropriate policy change.

The whole idea

Save token. Load token. Start Codex.

Guard handles the Orbio key, policy, budget, forwarding, and spend accounting.