OpenAI's Agents API is a hosted Codex runtime that connects to sandbox providers like E2B. OpenAI owns the model, the harness, and session lifecycle, and E2B owns where the agent's code executes. The following example is a workbench built on top of it.
OpenAI supports two ways to provision E2B: application-managed and webhook-managed. This example is application-managed: your application calls the E2B SDK directly to start, connect, and stop the sandbox, so the sandbox's lifecycle lives in your own code alongside the Agents API session.
Booting warm from a template
E2B sandboxes are built on Firecracker microVMs, so each session gets an isolated machine that cold-starts in under 60ms, optimizing chats for user experience.
The workbench builds its sandbox from a template with the Codex exec-server already baked in instead of installing dependencies at request time.
Create the sandbox and connect to its terminal with the E2B CLI:
e2b sbx create openai-agents-api-python-sdkEvery session in its own machine
The workbench consists of a Flask backend that pairs an Agents API session with an E2B sandbox for every chat, and a React frontend built on TanStack Router and Query.
Each session gets an E2B sandbox running the Codex executor; OpenAI runs the agent and maintains session state. When a user sends the first prompt, the backend creates an Agents API session and an E2B sandbox together, then streams the turn back to the frontend as it runs.
Scoping the sandbox to the chat instead of sharing one sandbox across the whole backend process means each conversation's agent can't see or touch another's filesystem. Teardown is per-chat too, and closing one conversation doesn't affect anyone else's session.
What's wired up
- Tools: OpenAI docs MCP, web search scoped to openai.com, and a function tool with the full result round trip
- Sessions: Streaming events, follow-ups, cancel, delete, and persistence across a backend restart
- Pause and fork: Branching a chat from its snapshot into a new sandbox and session
- Visibility: A workspace file viewer and live executor logs