AI Gateway HQ
Agents & CLIs · Client configuration

Operate Claude Code behind one governed boundary.

Use Claude Code's documented gateway base URL and token variables with a workload key on the Messages-compatible boundary.

Start in a test environment Read current API behavior
Runnable client path

Connect Claude Code without putting a provider secret on the machine.

Use the Messages-compatible boundary while AI Gateway HQ applies the selected route, budget, and policy before provider access.

Test the controls first
  1. 1
    Create a distinct workload

    Use one key for one environment or agent. Attach the hard dollar cap, rate boundary, approved route, and fallback before sending a request.

  2. 2
    Keep the key out of the configuration file

    Put AIGHQ_API_KEY in the local keychain, CI secret, or workload secret manager. The example contains no real credential.

  3. 3
    Prove both the allow and stop paths

    Run a small smoke test, inspect its metadata-only receipt, then exercise the zero-balance block and provider-health fallback.

Personal subscription allowances are not imported.

This setup uses an AI Gateway HQ workload credential. Requests are charged to the approved BYOK provider account or prepaid managed Bedrock balance selected by the route—not to a personal ChatGPT or Claude subscription allowance.

Claude Code configuration
export AIGHQ_API_KEY='paste-your-workload-key'

ANTHROPIC_BASE_URL=https://api.aigatewayhq.com \
ANTHROPIC_AUTH_TOKEN="$AIGHQ_API_KEY" \
claude --model company-approved-fast

Use the exact production origin shown. Replace only the workload key and organization-approved alias supplied inside the customer console.

Client configuration was checked against the vendor's current published interface. Review the primary documentation before a broad rollout because client capabilities change independently of the gateway.

Current shared controls

Status determines what can be configured.

Write-only, encrypted BYOK for implemented provider connections Stable model aliases and protocol-eligible route targets Organization and key budgets, RPM, TPM, and concurrency hard limits Observe, Shadow, Enforce, reason codes, and metadata-only evidence

Beta connections require customer validation against the exact model, payload, streaming mode, region, and provider account before production use.

Client boundary
AIGHQ_BASE_URL=https://api.aigatewayhq.com/v1
AIGHQ_API_KEY=from-your-workspace
AIGHQ_MODEL=company-approved-fast

Applications keep a stable gateway URL and model alias while an administrator changes eligible provider accounts and models.

Implemented boundary

Only documented protocols become eligible.

Set ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN for the intended shell or distribute them through approved settings and secrets tooling. A managed installer remains planned.

POST /v1/messages Anthropic-compatible streaming

Compatibility is bounded to the provider's current published interface. Review the provider documentation before approving a production model.

Client configurationCodex CLIClient configurationOpenCode