NomidNomid for Codex
Check on your Android and VR fleet from Codex
Add Nomid to Codex as an MCP server and ask about devices, policies and enrollment. Codex connects with an API key, and the key's permissions decide what it can do.
Which tablets in the Warehouse scanners policy haven't checked in since Friday?
Nomid · search_devices
3 of 42 devices in Warehouse scanners haven't reported since Friday. Two are almost out of battery; one stopped after a failed policy sync.
| Device | Battery | Last seen |
|---|---|---|
| WH-TAB-014 | 3% | Fri 17:12 |
| WH-TAB-022 | 4% | Fri 17:40 |
| WH-TAB-031 | 61% | Fri 09:05 · sync failed |
Should I send each of them a message asking the shift lead to charge them?
Yes, send itNot now
Try asking
Questions IT teams ask every day
Copy a prompt and paste it into Codex.
Your key starts read-only. Prompts that send a command, change a policy or create a QR code need a key with the command, policy changes or provisioning permission.
- How many devices are offline right now, by policy?
- Why can't I reach the tablet at the front desk remotely?
- Add our new scanner app to the Warehouse policy.
- Put WH-TAB-014 in lost mode with the IT desk number.
- Who logged in on the reception kiosk yesterday?
- Make a QR code to enroll new tablets into the Retail policy.
Setup
Connect Codex to Nomid
This page connects Codex with an API key you create in the Nomid portal. The key's permissions decide which tools work.
Codex
-
Create an API key in the Nomid portal.
- In the Nomid portal, open Settings and select the API tab.
- Click Create API Key and enter a name that identifies the assistant, for example Codex read-only.
- Choose the permissions described below. If you want the key to stop working on a given date, set an expiration date.
- Copy the key when it is shown. It is displayed only once.
-
Store the key in an environment variable named NOMID_API_KEY and never commit it to a repository. The URL in each example is the production endpoint.
-
Add this to ~/.codex/config.toml. Codex reads the token from the named environment variable. It does not expand variables written inside the file.
[mcp_servers.nomid] url = "https://api.nomid.tech/emm/api/mcp" bearer_token_env_var = "NOMID_API_KEY" -
Ask: "Give me a summary of my fleet."
Choose the key's permissions
- Read-only key
- Enable the device and policy read permissions (DEVICES_READ and POLICIES_READ). This is enough for every read tool and is the recommended starting point.
- Command key
- To let the assistant send device commands, also enable the device command permission (DEVICES_COMMAND). A command key must also have DEVICES_READ, and changing a device's policy also needs POLICIES_READ. Only a portal user who is allowed to send device commands and has access to all policies can create a key with this permission.
- Destructive command key
- To let the assistant wipe a device, reset or change its screen lock, relinquish ownership or uninstall apps, enable the destructive device command permission (DEVICES_COMMAND_DESTRUCTIVE) with DEVICES_READ. The company must also turn on destructive commands under AI agent access in the portal. The same portal user rules apply as for a command key.
- Provisioning key
- To let the assistant create provisioning QR codes, enable the provisioning permission (PROVISIONING) with POLICIES_READ. Only a portal user who is allowed to provision devices and has access to all policies can create a key with this permission.
- Policy changes key
- An API key with the POLICIES_WRITE permission (Policy changes), combined with POLICIES_READ. Only a portal user with permission to edit policies can create a key with POLICIES_WRITE. Required by the six POST endpoints and the MCP policy change tools.
Control
You stay in control
Commands need a key with the command permission. Policy changes need the policy changes permission and your company's policy changes setting. Provisioning QR codes need a key with the provisioning permission.
-
Reads first, acts second
Codex is instructed to confirm the right device and ask for your yes before it sends a command.
-
Policy changes wait for your approval
A policy change comes back as a proposal with a change list. The assistant is instructed to show it and wait for your approval, and high-impact changes also require you to type the policy name.
-
Destructive commands are off unless enabled
Wipe and screen lock reset need their own permission and your company's destructive commands setting. Once both are on, they run without a separate Nomid approval step, so keep them off unless you need them.
-
Your role, your companies
Codex works within the key's permissions and reaches only the companies the key gives it.
FAQ
Questions before you connect
Do I need an API key?
This page sets up Codex with an API key, the setup the Nomid developer docs describe. The key's permissions decide which tools work, so start with a read-only key. Claude, ChatGPT and Claude Code connect with Sign in with Nomid instead.
Can Codex wipe a device by mistake?
Destructive commands need a key or role with that permission and your company's destructive commands setting. Nomid's instructions to assistants require them to tell you exactly what happens to which device and to get your explicit yes first.
What does Codex see from my fleet?
Only the results of the tools it calls, within your access. In policy documents, secrets and app configuration values are hidden. Provisioning QR codes are created only when you ask; a code carries a live enrollment token valid for 24 hours and can contain the Wi-Fi password. Results also reach the AI service you connect, so review its privacy terms.
Connect Codex to your first device
Start free, enroll a device and ask Codex about it.