← Agent-GatewayUSE

USE

How to use

Two roles. Official keys stay on the operator box. Callers only receive a gateway key.

Operator

Owns the OpenAI and Anthropic console keys. Runs the box. Mints and revokes sk-gw- keys.

Caller

An agent or teammate. Sets two env lines. Never sees the console keys.

Caller, 90 seconds

OPENAI_BASE_URL=http://127.0.0.1:8787/v1
OPENAI_API_KEY=sk-gw-...

Ask the operator for the host if you are not on the same machine. Then send one chat request. Stop.

Cursor

Point the editor at the gateway. Paste the gateway key, not the console key.

OPENAI_BASE_URL=http://127.0.0.1:8787/v1
OPENAI_API_KEY=sk-gw-...

curl

curl -s http://127.0.0.1:8787/health
curl -s http://127.0.0.1:8787/v1/models \
  -H "Authorization: Bearer sk-gw-..."
curl -s http://127.0.0.1:8787/v1/chat/completions \
  -H "Authorization: Bearer sk-gw-..." \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"ping"}]}'

When it fails

200Upstream accepted the official key.
401 upstreamOfficial key rejected. The body is passed through.
429Upstream quota, or this key hit RPM / daily cap. Gateway cap sets Retry-After.
20s+ or 502Egress. See /troubleshoot on the gateway.
400 key missingOPENAI_API_KEY or ANTHROPIC_API_KEY is empty on the server.
401 bad gateway keyBearer missing, unknown, or revoked.

Operator, first hour

  1. docker compose up -d, or ./install.sh. Read the one-time dashboard token and bootstrap key.
  2. Put official console keys in .env. Leave them off every laptop.
  3. Open /keys?token=… and mint one teammate key. The secret is shown once.
  4. Send only the two env lines. Confirm /health and /v1/models.
  5. Revoke that test id. The same bearer must return 401.

Teach-back

  1. Where do the official keys live?
  2. Which two lines do you set?
  3. What happens when your key is revoked?
  4. What is this not?

On the server .env. BASE_URL plus sk-gw-. That bearer dies; console keys stay. Not Plus, not OAuth, not a public proxy.

← tools