Apache Casbin Gateway
2. Agents

2.1 Agents

Agents is the home page. Every AI coding agent installed on this machine is there, four cards to a row.

Agents

Each card names:

  • the account it is signed in to,
  • the provider it answers to,
  • what it spent, day by day over the last month, wherever its own transcripts carry that much,
  • and whether it is running right now.

An agent this machine does not have is listed too, so it can be installed from the same page.

How agents are found

Gateway reads the user accounts, home directories and install paths of the machine it runs on. That covers the layouts installers write and agents unpacked by hand onto PATH.

An agent hiding somewhere neither describes is pointed at directly: Locate browses this machine and lists the program you pick as an installation of its own, without moving or changing anything.

This is also why Gateway has to run on the machine whose agents you want to watch — in a container it reads the container's filesystem and finds nothing (5.4).

Starting and stopping

Start and Stop are on the card. An agent started from Gateway is the same installation you would have started yourself; Gateway only launches it.

Accounts

Codex keeps one sign-in at a time, and its own login overwrites whatever was there. So for Codex — the CLI and the ChatGPT desktop app, which share that sign-in — Gateway keeps copies: a ChatGPT subscription and an API key can both be held, and moving between them is a click rather than another sign-in.

On the card, the Account picker shows the sign-in in use and moves the agent to another saved one. The agent's own page has the full Accounts table:

What it does
Sign inRuns Codex's own browser sign-in against a directory of its own, so the account in use is left alone, and saves the account it brings back
Add API keySaves a key the way Codex stores one. Switching to it signs Codex in with the key instead of an account
UsePuts that saved sign-in in place
Usage leftFor a subscription account: how much of its short (five-hour) and weekly limits is left, when each fills back up, and how many rate limit resets the account still holds. Gateway asks OpenAI with that account's own token. A key has no plan limits and shows -
The binGateway forgets its copy. Whatever Codex is signed in to right now stays

The name of each account can be edited in place, so two accounts on the same plan are told apart without reading their emails.

A sign-in Gateway has no copy of is the one a switch would lose, so the page says so and offers Save this sign-in before anything else is picked.

An agent reads its sign-in when it starts. Switching while it runs says restart the agent for it to take effect; until then it keeps the account it started with.

Instances

Instances are the copies of one agent, each with a state directory of its own, so each is signed in to its own account and they run at the same time — several Claude Desktops, one per account, is the usual reason.

The installation itself is the first, listed as the Default instance: it runs on the state directory the agent uses when nothing hands it another one. It is named after the installation and cannot be renamed or removed.

  • Add instance creates another.
  • Remove instance makes Gateway forget it. The state directory, and the account signed in to it, are left on disk.

Only an agent Gateway knows how to give a separate state directory has instances.

The agent's own page

Opening a card gives the same information in full, plus the things that are set per agent:

SectionWhat it doesChapter
ProviderBind this agent to a provider, preview and write its configuration3.2
PermissionsThe same card as the Permissions page, for this agent4.1
MonitoringTurn on the audit-only record of what this agent does2.3
Outbound trafficWhere this agent's own processes send data2.3
Accounts, InstancesThe sign-ins Gateway keeps for it, and its copiesAbove
VersionsThe build it is on, and what its package manager publishes2.2
Sessions and spendIts own transcripts, and what they cost2.3, 4.3

Advanced view

Advanced view, linked from the home page rather than the sidebar, is the same installations as a table: one row per installation, with its path, how it was installed and which instance it belongs to. It is the view to use when one agent is installed twice and you need to tell the copies apart.

Next: 2.2 Agent versions.

Edit on GitHub
Apache Incubator

Apache Casbin (Incubating) is an effort undergoing incubation at The Apache Software Foundation (ASF), sponsored by the Apache Incubator. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.

Copyright © 2026 The Apache Software Foundation, Licensed under the Apache License, Version 2.0.

Apache, Apache Casbin, the names of Apache projects, and the feather logo are either registered trademarks or trademarks of The Apache Software Foundation in the United States and/or other countries. All other marks mentioned may be trademarks or registered trademarks of their respective owners.

On this page