AI Gateway HQ
Agents & CLIs · Client configuration

Operate Codex CLI behind one governed boundary.

Use an isolated Codex profile, a workload key, and the gateway's Responses endpoint without changing the user's normal provider configuration.

Start in a test environment Read current API behavior
Runnable client path

Connect Codex CLI without putting a provider secret on the machine.

Use an isolated Codex profile so the governed base URL and workload key do not alter your normal provider configuration.

Test the controls first
  1. 1
    Create a distinct workload

    Use one key for one environment or agent. Attach the hard dollar cap, rate boundary, approved route, and fallback before sending a request.

  2. 2
    Keep the key out of the configuration file

    Put AIGHQ_API_KEY in the local keychain, CI secret, or workload secret manager. The example contains no real credential.

  3. 3
    Prove both the allow and stop paths

    Run a small smoke test, inspect its metadata-only receipt, then exercise the zero-balance block and provider-health fallback.

Personal subscription allowances are not imported.

This setup uses an AI Gateway HQ workload credential. Requests are charged to the approved BYOK provider account or prepaid managed Bedrock balance selected by the route—not to a personal ChatGPT or Claude subscription allowance.

Codex CLI configuration
# Save as ~/.codex/aighq.config.toml; keep the key out of this file.
model = "company-approved-fast"
model_provider = "aighq"

[model_providers.aighq]
name = "AI Gateway HQ"
base_url = "https://api.aigatewayhq.com/v1"
env_key = "AIGHQ_API_KEY"
wire_api = "responses"
request_max_retries = 0
stream_max_retries = 0

# Then export AIGHQ_API_KEY and run: codex --profile aighq

Use the exact production origin shown. Replace only the workload key and organization-approved alias supplied inside the customer console.

Client configuration was checked against the vendor's current published interface. Review the primary documentation before a broad rollout because client capabilities change independently of the gateway.

Current shared controls

Status determines what can be configured.

Write-only, encrypted BYOK for implemented provider connections Stable model aliases and protocol-eligible route targets Organization and key budgets, RPM, TPM, and concurrency hard limits Observe, Shadow, Enforce, reason codes, and metadata-only evidence

Beta connections require customer validation against the exact model, payload, streaming mode, region, and provider account before production use.

Client boundary
AIGHQ_BASE_URL=https://api.aigatewayhq.com/v1
AIGHQ_API_KEY=from-your-workspace
AIGHQ_MODEL=company-approved-fast

Applications keep a stable gateway URL and model alias while an administrator changes eligible provider accounts and models.

Implemented boundary

Only documented protocols become eligible.

Create a separate aighq profile file, supply its workload key through AIGHQ_API_KEY, and use the organization-approved model alias. A managed installer remains planned.

POST /v1/responses GET /v1/models connection test

Compatibility is bounded to the provider's current published interface. Review the provider documentation before approving a production model.

Need the complete client-to-provider path? Follow the tested Codex CLI, AI Gateway HQ, and Groq setup

Client configurationClaude CodeClient configurationOpenCode