6.1 Frequently asked questions
Setup
Do I need a database, Go or Node? No. The install is one command and ships a single binary with the UI baked in (1.2).
Nothing is on http://localhost:17000.
Run casbin-gateway status. If a different program holds the port, Gateway names it and stops rather than taking it — free the port or change httpport in conf/app.conf (5.1).
I edited conf/app.conf and nothing changed.
The file seeds the settings on the first start only; after that they live in the database and are changed on the Settings page. The exceptions are httpport, driverName, dataSourceName, dbName and redisEndpoint, which are read before the database is open.
The Agents page is empty. Either Gateway is running in a container, which sees its own filesystem and not yours (5.4), or the agent is installed somewhere neither its installer nor PATH describes — use Locate (2.1).
Providers and routing
Which type do I pick for a reseller? Whichever API its own documentation describes. The type says what the provider speaks, not what your agents must — Gateway translates between all four APIs in both directions (3.2).
Can Codex run on DeepSeek or Kimi? Yes. Codex speaks OpenAI Responses and nothing else; Gateway translates for it. The same goes for Claude Code and the Gemini CLI on any provider (3.2).
My agent is on a ChatGPT or Claude subscription and I have no key. Pick the ChatGPT subscription or Claude subscription source and sign in: Gateway holds the subscription and spends it like a key, for every agent. To leave the sign-in with the agent that has it instead, set Authentication to the caller's own login (3.3).
What is cg-... in the environment snippet?
Gateway's own relay token, not a vendor key. The agent needs something in that variable; Gateway authenticates upstream with the provider's key instead (3.2).
Does a probe cost me money?
A few cents of that provider's own credit, stated on the report. providerProbeMode = "manual" probes only when asked, "off" never does (3.4).
Records and privacy
Is my prompt sent anywhere? No. Records are stored in Gateway's own database on this machine.
How do I stop prompts being recorded at all? Set the picker at the top of LLM Records — or Settings → LLM records — to Recording off, before routing an agent. Every relayed request is recorded in full by default (4.2).
Are API keys in the records? Request headers are never recorded, and credential-shaped values in a body are replaced before it is stored, with the number of replacements shown on the record.
Permissions
I turned off the terminal and the agent still ran a command. Check where that agent is enforced. Tool switches hold for agents routed through Gateway and for monitored agents, through the hook; an agent that is neither routed nor monitored is not held to anything. The Permissions page says which case it is in (4.1).
Can I write policy by hand?
Yes. Advanced shows the Casbin model.conf and policy.csv, and takes extra lines of your own, which are checked before the ones the switches wrote (4.1).
Usage and cost
Usage shows spend for an agent I never routed through Gateway. That is the point: the Agent spend tab reads the agents' own transcripts, so it counts requests that never came through here. Relayed spend is the narrower account of the traffic that did (4.3).
The cost is wrong for my reseller.
Edit the model's price on Model pricing, and it is left alone from then on. Or point llmPricingFile at your own rates (4.3).
Elsewhere
- Issues — open one; for a change, opening an issue first is the recommended way to talk it through.
- Discord
- Online demo