Apache Casbin Gateway
1. Getting started

1.4 Quick start

Five minutes, from a fresh install to an agent whose traffic you can read.

Step 0 — what you already have

Open Agents. Every agent installed on this machine is there, with the account it is signed in to, the provider it answers to and what it spent, day by day over the last month wherever its own transcripts carry that much.

Usage is already populated too, from those same transcripts. Neither needed a provider, a key or any routing. If all you wanted was to see what the agents on this machine are costing you, you are done.

Step 1 — add a provider

Providers → Add:

  1. Pick the type: OpenAI-compatible or Anthropic-compatible.
  2. Paste the vendor's base URL and API key.
  3. List the models it serves.

Gateway probes it against the upstream before storing it, and Authenticity starts grading it on its own from here.

No API key, because you have a ChatGPT or Claude subscription? Pick that subscription as the source and sign in — 3.3.

Step 2 — point an agent at it

Agents → open an agent → pick that provider.

  • For an agent whose configuration format Gateway knows, Write configuration puts it in the agent's own file. Preview shows exactly what that will be first, and Restore undoes it.
  • For any other agent, copy the environment snippet the page shows and start the agent from a shell that has it:
export ANTHROPIC_BASE_URL="http://localhost:17000/v1/agents/claude-code"
export ANTHROPIC_AUTH_TOKEN="cg-..."

That token is Gateway's own relay token, not a vendor key. The agent refuses to start without something in that variable; Gateway authenticates upstream with the provider's key instead.

Picking a different provider afterwards rewrites the file on the spot, so switching from then on is one click.

Step 3 — run the agent, then read what it sent

Use the agent normally, then open LLM Records: every request it relayed is there — the full system prompt, every message and tool call, the schema of every tool the model was offered, plus tokens and cost.

If that is more than you want kept, change it before routing an agent: the picker at the top of the page switches between Recording off, Record metadata and Record metadata and bodies (4.2).

Step 4 — decide what that agent may do

Permissions → pick the agent. Around forty switches over its tools, in six groups, plus which models and which providers it may use. A tool switched off is taken out of the request before it leaves this machine, so the model is never offered it (4.1).

Where to go next

If you want toRead
Know whether the reseller behind that key is honest3.4 Authenticity
Run Codex on a model Codex does not support3.2 Routing
Install or roll back the agents themselves2.2 Agent versions
Give an agent GitHub, Notion or a folder, without pasting a token into it2.5 Connections
Let another machine use this Gateway5.2 Security and serving other machines
Edit on GitHub
Apache Incubator

Apache Casbin (Incubating) is an effort undergoing incubation at The Apache Software Foundation (ASF), sponsored by the Apache Incubator. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.

Copyright © 2026 The Apache Software Foundation, Licensed under the Apache License, Version 2.0.

Apache, Apache Casbin, the names of Apache projects, and the feather logo are either registered trademarks or trademarks of The Apache Software Foundation in the United States and/or other countries. All other marks mentioned may be trademarks or registered trademarks of their respective owners.

On this page