Configure the Sensor gateway

Use this path when your organization runs Cortex Sensor as a gateway in its cluster. Your command-line tool connects directly to that gateway; you do not need a local Sensor installation for this connection.

The gateway uses the same capture and monitoring pipeline as Sensor. It captures supported traffic and attributes it to you from the personal capture token sent with each request.

Before you start

You need:

• The Cortex gateway URL from your organization administrator
• A personal capture token
• A supported command-line tool that can set a gateway base URL and a custom HTTP header

Use the gateway URL exactly as provided. Do not add or remove a path such as /v1 unless your administrator tells you to.

Create a personal capture token

1. Sign in to Cortex.
2. Open your profile, then select Settings.
3. Under Devices & tokens, select Generate token.
4. Copy the token and store it in your approved secret manager.

A personal token identifies the activity sent through the shared gateway. Treat it like a password: do not put it in source control, terminal history, screenshots, or shared configuration. Generate a replacement token if you think it was exposed, and revoke the old token in the same Devices & tokens section.

Connect your command-line tool

Configure the tool to send requests to the gateway URL and include this header on every request:

If your tool is behind another corporate proxy or gateway, that component must preserve X-Chaos-Capture-Token when it forwards requests.

Example: Codex

Add a provider for the Cortex gateway to ~/.codex/config.toml, replacing the placeholders with values supplied by your organization:

model_provider = "cortex"

[model_providers.cortex]
name = "Cortex gateway"
base_url = "https://<your-cortex-gateway>"
wire_api = "responses"
http_headers = { "X-Chaos-Capture-Token" = "<your-personal-capture-token>" }

Keep the token outside a repository. If your organization manages Codex configuration, ask its administrator to provide the equivalent managed configuration rather than editing the file yourself.

Verify the connection

1. Start a new session in the configured command-line tool.
2. Send a test prompt.
3. Open Home → Activity in Cortex and confirm that the activity appears under your account.
4. If your organization uses monitoring views, confirm the request appears there as well.

A successful response from the model confirms the gateway route, but it does not confirm attribution. The activity must appear under your account before setup is complete.

If the model responds but activity is missing, first check that the tool is using the intended gateway URL and sending X-Chaos-Capture-Token on every request. If the issue continues, generate a new token and contact your Cortex administrator with the approximate test time and tool name; never send the token itself.