1.4 Quick start
Five minutes, from a fresh install to an agent whose traffic you can read.
Step 0 — what you already have
Open Agents. Every agent installed on this machine is there, with the account it is signed in to, the provider it answers to and what it spent, day by day over the last month wherever its own transcripts carry that much.
Usage is already populated too, from those same transcripts. Neither needed a provider, a key or any routing. If all you wanted was to see what the agents on this machine are costing you, you are done.
Step 1 — add a provider
Providers → Add:
- Pick the type: OpenAI-compatible or Anthropic-compatible.
- Paste the vendor's base URL and API key.
- List the models it serves.
Gateway probes it against the upstream before storing it, and Authenticity starts grading it on its own from here.
No API key, because you have a ChatGPT or Claude subscription? Pick that subscription as the source and sign in — 3.3.
Step 2 — point an agent at it
Agents → open an agent → pick that provider.
- For an agent whose configuration format Gateway knows, Write configuration puts it in the agent's own file. Preview shows exactly what that will be first, and Restore undoes it.
- For any other agent, copy the environment snippet the page shows and start the agent from a shell that has it:
export ANTHROPIC_BASE_URL="http://localhost:17000/v1/agents/claude-code"
export ANTHROPIC_AUTH_TOKEN="cg-..."That token is Gateway's own relay token, not a vendor key. The agent refuses to start without something in that variable; Gateway authenticates upstream with the provider's key instead.
Picking a different provider afterwards rewrites the file on the spot, so switching from then on is one click.
Step 3 — run the agent, then read what it sent
Use the agent normally, then open LLM Records: every request it relayed is there — the full system prompt, every message and tool call, the schema of every tool the model was offered, plus tokens and cost.
If that is more than you want kept, change it before routing an agent: the picker at the top of the page switches between Recording off, Record metadata and Record metadata and bodies (4.2).
Step 4 — decide what that agent may do
Permissions → pick the agent. Around forty switches over its tools, in six groups, plus which models and which providers it may use. A tool switched off is taken out of the request before it leaves this machine, so the model is never offered it (4.1).
Where to go next
| If you want to | Read |
|---|---|
| Know whether the reseller behind that key is honest | 3.4 Authenticity |
| Run Codex on a model Codex does not support | 3.2 Routing |
| Install or roll back the agents themselves | 2.2 Agent versions |
| Give an agent GitHub, Notion or a folder, without pasting a token into it | 2.5 Connections |
| Let another machine use this Gateway | 5.2 Security and serving other machines |
1.3 The interface
Everything is at http://localhost:17000, in the desktop window or in a browser. The sidebar is the whole product, in the order you would set it up: the agents, the models behind them, the gates they pass through, then what they ran and what it cost, with settings last.
2.1 Agents
Each card names: