Team & Enterprise AI Setup

OpenAI / Codex

Atom includes the Codex runtime, but Codex still reads the normal local Codex account and configuration on the computer.

Use this path if your team uses ChatGPT Business, ChatGPT Enterprise, OpenAI API billing, or managed Codex policy.

1. Configure Codex on the computer using your team’s standard setup.
2. Sign in with the company ChatGPT account, or configure the team’s OpenAI API key setup.
3. If your team uses managed policy, let your admin manage it through OpenAI’s managed requirements, MDM, or system configuration.
4. Open Atom.
5. Open Settings → Security and select Provider Settings so Atom follows the managed Codex policy.

config.toml is useful for local defaults. It is not a replacement for sign-in or API-key setup, and enterprise-managed requirements take priority over local files.

Official docs: Codex managed configuration

Allow Atom’s tools in Codex policy

In Provider Settings, Atom supplies its Adobe tools to Codex as local MCP servers named atom-ae (After Effects) or atom-premiere (Premiere Pro), plus atom-chat for shared chat tools. They accept only local connections on 127.0.0.1 at /mcp, on a port the operating system assigns when a chat starts, and run only while the Atom panel is open. If your organization enforces an MCP allowlist without them, Codex disables the servers and the agent cannot control the Adobe project.

Codex enforces MCP allowlists through requirements.toml. When an mcp_servers allowlist exists, add Atom’s servers by name and loopback URL pattern (not a fixed port), and keep every other permitted server listed:

[mcp_servers.atom-ae.identity.url]
match = "regex"
expression = '^http://127[.]0[.]0[.]1:[0-9]+/mcp$'

[mcp_servers.atom-premiere.identity.url]
match = "regex"
expression = '^http://127[.]0[.]0[.]1:[0-9]+/mcp$'

[mcp_servers.atom-chat.identity.url]
match = "regex"
expression = '^http://127[.]0[.]0[.]1:[0-9]+/mcp$'

To let Atom’s tools run without a prompt for each call, set the server’s approval mode in managed defaults (managed_config.toml, or the equivalent MDM payload):

[mcp_servers.atom-ae]
default_tools_approval_mode = "approve"

[mcp_servers.atom-premiere]
default_tools_approval_mode = "approve"

[mcp_servers.atom-chat]
default_tools_approval_mode = "approve"

This approves only the tools on the named Atom server, including tools that change the Adobe project. Shell, file, and network access still follow the rest of your Codex policy. Without it, Codex asks in the Atom conversation before running a tool, and users can choose Allow for this chat where Codex offers it. Individual users can set the same keys in their own ~/.codex/config.toml when no managed policy applies.

Official docs: Codex managed configuration and config reference