Veyra

Connecting a payment tool

How to give OpenAI Codex a payment tool via MCP

Configure a remote MCP payment server in Codex's config.toml with bearer_token_env_var, keep the token in your environment, and test the flow.

Add the server to Codex's config.toml as an [mcp_servers.<name>] table with its url, and set bearer_token_env_var to the name of an environment variable holding the token. Codex then sends it as the Authorization header on every request.

Why is this harder than it sounds?

Codex often runs with less supervision than an editor assistant, including long tasks and scripted runs. That makes server-side limits more important, and it makes where the token lives matter: a token typed into a config file is copied into backups and dotfile repos, while an environment variable stays with the shell or secret store that set it. Codex's docs document both a bearer-token environment variable and a static headers map; the first keeps the secret out of the file.

How do you do it?

  1. Create a credential for Codex. Make a dedicated endpoint with small limits. If Codex will run unattended, keep the auto-approve limit low and use a recipient allowlist.
  2. Export the token. Set an environment variable such as VEYRA_TOKEN in the shell or secret store Codex runs from.
  3. Add the server to config.toml. In ~/.codex/config.toml add [mcp_servers.veyra] with url = "https://veyra.money/api/mcp" and bearer_token_env_var = "VEYRA_TOKEN".
  4. Or use the CLI. codex mcp add <name> --url <url> adds a remote server; Codex's docs describe setting the bearer token variable in config.toml.
  5. Check the tools load. Start Codex and ask it to call get_budget. It should report your limits.
  6. Run a test task on a simulated source. Give it a task that needs one small payment and one in the approval band. Confirm it hands you the approval link and stops.

What it does not mean

  • bearer_token_env_var is the variable's name, not the token. Putting the token itself there will not work.
  • A static http_headers entry with the token in it works but writes the secret into the file.
  • Codex completing a task does not mean a held payment went through. Check the payment's status.

Common questions

Does Codex need the stdio bridge?

No. Codex can talk to a remote HTTP server and send a bearer token, so it connects to Veyra directly.

What happens if the variable isn't set?

Codex has no token to send, and Veyra answers that the credential is missing. Nothing is paid.

Where does Veyra fit?

Veyra's endpoint accepts exactly this: a bearer token beginning veyra_ in the Authorization header at https://veyra.money/api/mcp. The veyra-mcp README shows the Codex setup. Everything else, from limits to the approval band, the allowlist and the daily cap, is enforced by Veyra, so Codex's config can only connect or fail to connect, never widen the policy.

Start free with a simulated walletRead the docs

Sources

Terms on this page

This page explains how agent payments and the related technology work. It is not financial, investment, legal or tax advice. Protocols and provider features change; check the linked official sources before relying on a detail.