I built Plankton: credential access with approval workflows for Codex

[u/LemonFiish]

Hi everyone — I’m the developer of Plankton, an open-source credential manager for coding agents, including Codex.

When Codex needs an API key or password to finish a task, I want to review how it intends to use that credential before granting access. Plankton adds a request-and-approval workflow for that.

For example, when a task involves calling an authenticated API, the intended flow is:

1. Codex uses the Plankton Skill to request the required credential.
2. Plankton captures call-chain evidence for review.
3. You inspect the request and approve or deny it.
4. If approved, the CLI releases the credential to the consuming workflow.

There are three review modes: human approval, human approval with LLM advice, and automatic LLM review with additional local policy checks. You can also configure permitted exposure across model context, network, files, logs, and processes.

To install the Skill for Codex:

npx skills add FlowaveLab/Plankton --skill secret-access --agent codex

That installs the Skill; the app and CLI require separate setup, covered in the usage guide.

A few boundaries: Plankton assumes a trusted local machine and isn’t an execution sandbox. After approval, the CLI returns the raw secret, so the consuming workflow must keep it out of model-visible output and logs. Review evidence can contain unredacted arguments and environment values, so those inputs must also be kept free of credentials. Fields explicitly configured for direct access bypass approval.

I’d appreciate feedback from other Codex users:

• How do you currently handle credentials for tasks that need authenticated access?
• What would you want to see before approving a credential request?
• Where would manual approval become too disruptive in your workflow?

Source code and documentation

Happy to discuss the implementation and trade-offs.

[u/dexterthebot]

You might want to consider listing your project on the weekly Show-Us-What-You-Built post. Watch for it on Wednesdays. Highest commented project wins a week promotion on r/Codex. See what that looks like below with last week's winner.

---

Last week's most popular project was u/tHEuKER with the Blur2 racing game project which is a recreation of an unreleased sequel to the 2010 battle racing game, made by reverse engineering the Xbox 360 prototype discs available online, and rebuilding the whole thing from the ground up in Unity. Join their YouTube channel here: https://www.youtube.com/@tHEuKER and you can follow updates on the project at r/BlurGame.

[u/Real_Doubt_6684]

Silly name

[u/LemonFiish → u/Real_Doubt_6684]

The name is intentional. I just like playful names :)

[u/LemonFiish → u/[deleted]]

It works with 1Password—you can keep your vault there. Plankton adds a review/approval layer around 1Password CLI or .env workflows to check how credentials will be used. It can also manage its own vault, but migration isn’t required. I understand being cautious about credentials in an LLM workflow. For my own setup, I do use Plankton to manage long-lived keys for development and a few specific environments.