What OpenAI's Agents API costs, and who can't use it yet

OpenAI opened the Agents API to every developer in public beta on 10 September 2026, and what it rents you is the agent loop that already runs Codex, hosted on OpenAI's own machines behind a single call to a sessions endpoint. It bills on 2 meters rather than one, the model tokens at the usual API rates and, whenever you give the agent a computer to work on, a sandbox charged at container rates, and no ChatGPT subscription pays for either of them.

One sentence in the documentation settles the matter for a whole class of companies before the price is even discussed. OpenAI writes that the Agents API "currently supports data residency only in the United States and does not support Zero Data Retention (ZDR)", and it adds that choosing your own sandbox does not change that.

Most of what has been written since the announcement describes the orchestration code you no longer have to write, which is real and which every vendor will tell you about. This piece reads the meters instead, because the questions a builder actually has tonight are what a single run costs, who is allowed to start one, and what the agent can reach from inside its box while it works.

What is the OpenAI Agents API, in plain terms?

The OpenAI Agents API is a hosted service, now in public beta, that runs an agent on OpenAI's infrastructure and keeps its state between tasks, so your application hands over a job and collects the result instead of running the loop itself. OpenAI describes it as running the Codex agent for you and managing the infrastructure underneath it.

Underneath, it is built out of 4 objects, and the naming is plain enough to hold in your head. An Agent is the model, the instructions you give it, the tools it may call and any MCP servers it may reach. An Environment is the optional computer where it reads files, installs packages and runs commands. A Session is the durable thing that carries the work across turns, and events and items are what goes in and what comes back out.

The request that starts one is ordinary. You post to the sessions endpoint with a beta header, name a model, say what kind of environment you want, and pass the task as plain English.

curl https://api.openai.com/v1/agents/sessions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "OpenAI-Beta: agents=v1" \
  -H "Content-Type: application/json" \
  -d '{
    "agent": { "model": "gpt-6-astra", "instructions": "Write clean code, run it, and report the actual output." },
    "environment": { "type": "openai_hosted" },
    "input": "Sum the amount column in /workspace/amounts.csv",
    "stream": true
  }'

What comes back is a stream of events, and the one that means the work finished is called agent.session.turn.completed. The documentation is careful on this point in a way vendors usually are not, warning that a completed turn does not guarantee that every tool inside it succeeded, which tells you something about how much checking you still owe the output.

Nothing was retired to make room for it. OpenAI's own comparison puts the Agents API beside the Agents SDK and the Responses API, and the line it draws is about where the loop runs. The Agents API means OpenAI runs the agent and saves its progress, the SDK runs inside your application with your storage behind it, and the Responses API leaves you calling models directly and building the loop yourself. If you have been following how the Codex command line tool stacks up against its closest rival, our comparison of Claude Code and Codex covers the ground this product is now hosting for you.

What does one Agents API run actually cost?

An Agents API run bills on 2 separate meters, and only one of them is the model. Tokens are charged at the chosen model's normal API rates, exactly as they would be anywhere else on the platform, and the sandbox the agent works in is charged as a container on top of that. OpenAI's pricing page lists the smallest sandbox at $0.03 for a 20 minute session, billed by the minute with a 5 minute minimum for each session.

Said in money you can picture, switching on the cheapest computer an agent can have costs well under a cent, and the minimum is charged even when the work takes seconds. The larger sizes climb in proportion, so a memory hungry job on the biggest box lands somewhere near the hourly price of a modest cloud server. That is not the line on the invoice that will hurt you.

The tokens are where the money actually goes, because an agent reads its own history back on every single turn. The flagship model the documentation uses in its examples is the most expensive entry on OpenAI's price list, and an agent that retries a failing test a dozen times pays for every attempt and for the transcript it drags along behind it. Before you leave one of these sessions running unattended, our comparison of what the big model APIs charge for the same 3 jobs is the sanity check worth an hour of your evening.

The sandbox also does not switch off when the agent stops talking. OpenAI writes that connected sandboxes receive keep alives, including between turns, and that if activity and keep alives stop for an hour the sandbox can be deleted, a timeout the documentation says is not configurable. Deleting the session when you are finished is what asks for cleanup, and closing the event stream does not cancel the task, which is the sort of detail that turns into a surprise at the end of a month.

Put beside the 2 other ways to run the same agent, the trade becomes easy to read.

Does a ChatGPT Plus or Pro plan pay for any of this?

No. The Agents API bills through the OpenAI platform, and OpenAI's pricing documentation says that usage authenticated with a platform credential is charged at API pricing rather than counted against a ChatGPT subscription.

The distinction catches the people most likely to want this product, because they are already paying for Codex. A ChatGPT Plus seat at $20 a month and a Pro seat from $100 a month both include Codex inside OpenAI's own apps and inside the Codex command line tool when you sign in with that account, and the allowance there is counted in messages over rolling windows rather than in tokens. The Agents API does not touch that allowance at all.

It wants platform credentials instead, scoped to read and write agent sessions plus the scope that lets it call the model, and every token and every container minute it spends lands on the platform invoice. For a solo builder that is the difference between a predictable monthly line and a bill that moves with how hard your agent tried, which is a genuinely different relationship with your own tooling.

None of this is a trick, and it is the ordinary arrangement for any API, which the launch coverage mentions only in passing. It is still a change of shape for anyone whose mental model of Codex is a flat fee they have already paid, and the first invoice is a poor moment to find that out.

Who can't use the Agents API yet?

Anyone who needs data held outside the United States, and anyone bound by Zero Data Retention terms, cannot use the Agents API today. OpenAI states the restriction in the overview page of its own documentation rather than burying it in a legal annex, which is to its credit.

The Agents API currently supports data residency only in the United States and does not support Zero Data Retention (ZDR).

The sentence after it closes the obvious escape route, because OpenAI adds that choosing a sandbox you host yourself does not make the Agents API eligible for Zero Data Retention. The orchestration is the thing sitting in the United States, not only the computer the agent types on, so moving the computer does not move the transcript, the session configuration or the saved items.

In practice that rules out a European team whose contract promises customer data stays in the European Union, a health or finance group whose agreement says nothing is retained once a call completes, and anyone whose procurement questionnaire has a residency box that must be ticked before a tool is approved at all. Those are ordinary companies, and they are exactly the ones that would happily pay somebody else to run an agent loop safely.

OpenAI wrote "currently", which reads like a restriction meant to lift, and restrictions of this kind usually do lift once a product leaves beta. A plan still cannot be built on it, and the honest position for a regulated team this week is to prototype on something else and check the page again in a month.

What can the agent reach from its sandbox by default?

By default, a sandbox hosted by OpenAI is allowed to make outbound network calls. The documentation lists 3 settings for network access, enabled which allows outbound traffic and is described as the default unless you inherit a template policy, disabled which blocks it, and restricted which allows only the hosts you name.

Restricted mode is stricter than it first looks, and reading its rules is worth the minute it takes. It accepts exact host names only, with no wildcards, no protocols, no paths and no ports, and subdomains and redirect destinations each need an entry of their own. Hosted MCP servers of the stdio kind currently require the open setting, which is a real corner to know about before you design a locked down session around them.

An agent that reads a web page and then runs a command inside a box with outbound access is the exact pattern behind most of the prompt injection stories of the last year, and the default here leans toward convenience. Simon Willison, who tested the setting on the day it shipped, reported on the launch thread that a blocked request came back with the message "Domain forbidden", and that the model declined his suggestion to edit the hosts file to route around it, saying that would be an attempt to bypass the restriction.

Changing that single setting is the cheapest safety work available here. Setting network access to disabled for any session that has no reason to reach the internet costs nothing, removes the most interesting attack surface in the product, and can be reversed the moment a task genuinely needs a fetch. It is the first thing to change on a beta you are trying out with credentials that can spend money.

Do you need it, when the same agent runs free on your own machine?

The agent the Agents API runs for you is the Codex command line tool, which OpenAI publishes on GitHub under the Apache 2.0 licence, so the same software runs on a laptop you already own for the price of the tokens alone. That is the comparison worth holding in mind while reading the container line on the pricing page.

The environment setting is what decides how much of OpenAI's machinery you actually rent. Set it to none and there is no sandbox and no container meter at all, which suits an agent that only calls your own functions and MCP servers and never needs a shell. Set it to the hosted sandbox and you are paying for a Linux workspace with Python, Node.js and the usual command line tools, provisioned and connected for you.

The third option keeps the loop on OpenAI's side while the commands land on a computer you control. You install the Codex package and run its executor there, and the documentation asks for outbound access to OpenAI, a separate restricted credential for the executor, and your own provisioning and cleanup around it.

npm install -g @openai/codex@alpha
codex exec-server

You can already run this agent yourself, and plenty of people do, in a virtual machine on a spare box, for nothing beyond the tokens. What the Agents API sells is somebody else patching that sandbox, scaling it, isolating it from their other customers and holding the session state when your own process dies at 3am. The honest test is whether an evening of your time and a weekend of maintenance is worth more or less than the container line on next month's invoice.

If you are still choosing a lane, our ranking of the tools that build and run agents for you, with their real prices covers the managed end of this market, and what an agent's memory actually holds between turns explains the state problem the Agents API is charging you to solve on your behalf.

What we do not know yet about the Agents API

Several things that decide whether this is cheap or expensive are simply not published, and saying so is more useful than guessing at them. The pricing page says the container minimum is charged for each session, and the pages we read do not spell out what happens when a sandbox goes quiet and is woken again inside the same session, so whether a long running agent pays that floor once or repeatedly is unclear.

There is no published date for the end of the beta. Every request still carries a beta header, OpenAI has not named a general availability date that we could find, and the prices that apply today are the standard container and token rates rather than a rate card written for this product, which means they can move when the beta closes.

The reliability and cost improvements circulating this week come from customers quoted in the launch post, and nobody outside those companies has reproduced them. We have not run a long agent session against a real invoice either, so anyone publishing a total cost for a real workload this week, ourselves included, is doing arithmetic rather than reporting a measurement, and the difference matters.

The pages we read also do not state a ceiling on how long a session may live, how many sessions one account may run at once, or what happens to the work when a turn fails midway through a sequence of tool calls. The documentation does warn that a completed turn does not guarantee every tool succeeded, which is honest, and it leaves the retry policy and the checking to you.

Residency is described as a current state rather than a commitment. OpenAI has not said when, or whether, the Agents API will store data outside the United States, or when Zero Data Retention might apply to it, so a team that needs either one has nothing to plan against beyond checking the page again later.

What to do tonight if you want to try the Agents API

Start with the residency sentence, because it either rules you out or it does not, and no amount of clever design works around it. If it does not rule you out, the cheapest useful experiment is a session with the environment set to none, which skips the container meter entirely and tells you whether a hosted loop is even the shape you want before you pay for compute you may not need.

When you do want the sandbox, set network access to disabled for the first run, give the agent a task that has no reason to touch the internet, and delete the session the moment it finishes rather than letting the hour of keep alives quietly run out on its own. Then look at the bill the next morning and find both lines, the tokens and the container, because a meter you have never seen is a meter you will not think to watch.

What is worth watching over the next few weeks is whether the beta header disappears and what the pricing looks like when it does. A managed agent loop sold by the company that also sells the model is a comfortable place to build and an awkward place to be stuck, and the version of this product that regulated teams can actually use is the one with a residency option and a rate card, whenever that arrives. Our piece on what changed for people paying for ChatGPT when the new flagship model landed is the background on the model these sessions reach for by default.