How Mile-Post actually works
No jargon — here’s exactly what happens from the moment you sign in to the moment you get a reply from a model.
The short version
You already have a ChatGPT account — Free, Plus, or Pro. That account can talk to OpenAI’s models. Normally, only the ChatGPT website and app do that talking for you. Mile-Post signs in as you (with your permission) and gives you a key that lets any other app talk to those same models, using your same account — no separate OpenAI API subscription, no extra bill.
Step by step
- 1
You sign in with ChatGPT
We use a “device code” flow — the same kind of sign-in smart TVs use for streaming apps. You get a short code, enter it on a real OpenAI page in your browser, and approve access. We never see or ask for your ChatGPT password.
- 2
We keep a login token for your account, safely
Once you approve, OpenAI hands back a login token (like a temporary, revocable password) — not your real password. We store it encrypted, and only our server can use it to make requests as you.
- 3
We generate your API key
This is a random string starting with
sk-milepost-. It doesn’t contain your login token — it’s just a lookup code that points back to your account on our server. We show it to you once. After that, we only ever store a one-way hash of it (think: a fingerprint you can’t reverse into the original), so even we can’t look it back up. - 4
You use the key like any other OpenAI key
Set it as your
OPENAI_API_KEYand point the base URL at ours. Every tool that speaks the standard “Chat Completions” format — the OpenAI SDK, LangChain, LiteLLM, Cursor, plain curl — just works, unmodified. - 5
What happens on every request
When a request arrives with your key, we: (1) hash it and look up whose account it belongs to, (2) decrypt that account’s stored login token — refreshing it first if it’s about to expire, (3) send your message to OpenAI’s backend as if it came from the ChatGPT app itself, and (4) translate the reply back into the standard format your tool expects, streaming it back token by token if you asked for streaming.
Common questions
Does this cost extra?
No separate bill from us. Requests count against your existing ChatGPT plan the same way using chatgpt.com does.
Is this an official OpenAI product?
No. It’s an independent project that signs in through the same door the official Codex CLI uses. See the security page for what that means in practice.
What if I revoke my key?
It stops working immediately — the lookup for its hash simply won’t find anything anymore. Anything already mid-request finishes; nothing new gets through.
Can I have more than one key?
Yes — create as many as you want, one per project or environment. Revoking one only invalidates that key; the rest keep working.
Want the honest security details?
We wrote a whole page about what this design does and doesn’t protect against, including the risks that are inherent to how it works.
Read the security page