What a complete Codex backup needs to cover
Git and Codex protect different layers of your work. Git records repository history. Codex also keeps user-level state outside an individual repository, including configuration, sessions, skills, logs, authentication material, and other runtime state under its state root.
OpenAI documents CODEX_HOME as the root for Codex state. If you have not changed it, Codex uses the .codex directory in your Windows user profile. Advanced configurations can also move SQLite-backed state, so record any custom state-location overrides as part of your backup plan.
- Your native Windows CODEX_HOME, normally %USERPROFILE%\.codex
- Any explicitly configured separate SQLite state location
- Your Git repositories and uncommitted work, protected through Git and a separate file backup
- A written note of custom configuration or environment-variable overrides
A safer manual backup process
- 01
Locate the active state root
Check whether CODEX_HOME is set. If it is not, use the .codex folder inside your Windows user profile. Do not assume a WSL path and a native Windows path are the same workspace.
- 02
Close active Codex processes
For a simple file copy, close Codex first so files are not changing while the copy is made. Automation built for live capture needs its own consistency controls; an ordinary copy command does not provide them.
- 03
Handle credentials deliberately
OpenAI says auth.json can contain access tokens and should be treated like a password. Do not place an unencrypted copy in a shared drive, repository, or broadly accessible synced folder.
- 04
Store a separate copy
Use a destination that can survive loss of the PC, such as protected external storage or a private synced location. A second folder on the same drive does not protect against device loss. If you keep repeated full-folder copies, unchanged data is stored again each time, so plan capacity and retention accordingly.
- 05
Test the copy away from live state
Inspect or reconstruct the backup in a separate folder. A copy is not a proven backup until you can read the expected state without changing your active Codex home.
Common mistakes
- Backing up only the source repository and assuming Codex sessions are inside it
- Copying auth.json into Git, a support ticket, or an unencrypted archive
- Keeping the only backup on the same Windows drive
- Retaining repeated full-folder copies without monitoring how quickly storage grows
- Never checking whether the copied state can actually be reconstructed
- Mixing native Windows Codex and WSL paths without confirming which environment owns the state
What Calmbu currently claims
You can maintain this process yourself if you keep the active Codex locations, exclusions, storage, retention and recovery tests current. Calmbu packages that recurring work into maintained agent-aware protection, AES-256-GCM encryption, storage-efficient recovery points that reuse unchanged protected data, and required recovery checks. The public Windows installer remains gated.
See the recovery model How Calmbu verifies its claimsCommon questions
Does copying my project folder back up Codex?
No. It protects that project folder, but Codex also keeps user-level state under CODEX_HOME. Use Git and project backups for code, and a separate Codex-state backup for the workspace layer around it.
Should I back up auth.json?
Treat auth.json like a password because it may contain access tokens. A security-conscious backup should exclude it or protect it with strong encryption and strict access controls. Signing in again is usually safer than moving a plaintext credential file.
Can I back up Codex while it is open?
A purpose-built backup tool can account for changing files, but a simple manual folder copy cannot guarantee a consistent point in time. Close Codex before a manual copy.
Will repeated manual Codex backups use more storage?
They can. If every backup is another complete folder copy, unchanged local workspace data is stored again each time. Calmbu reuses unchanged protected data across recovery points, so a new point does not require another complete copy. Actual storage use still depends on how much supported workspace data changes.
Official references used for Codex facts
OpenAI documentation establishes Codex behaviour. Calmbu-specific statements describe the current product contract and are not presented as OpenAI guidance.