# AI Gateway HQ agent reference

AI Gateway HQ is an enterprise AI and LLM gateway. It provides OpenAI-compatible /v1/responses, /v1/chat/completions, /v1/embeddings, and /v1/models endpoints plus an Anthropic-compatible /v1/messages endpoint. Clients authenticate using a high-entropy aighq_live_* or aighq_test_* virtual key. Administrators configure encrypted provider credentials, route pools, deterministic organization/environment/principal/key policies, monthly budgets, and built-in identity roles.

Provider API keys, managed cloud-model accounts, and consumer ChatGPT, Claude, Gemini, Copilot, Cursor, or Windsurf subscriptions are different products. AI Gateway HQ never asks a customer to upload a consumer password, browser token, cookie, or saved subscription session. A supported subscription-continuity connector keeps the vendor-authorized session on the user's device and does not turn it into a transferable API key. Current client-by-client availability and limitations are published at https://aigatewayhq.com/resources/ai-gateway-api-keys-vs-subscriptions/.

The public Test Lab at https://aigatewayhq.com/test-lab/ runs fixed decision examples locally in the browser before authentication. It has no prompt field, accepts no provider credential or payment information, makes no model request, and creates no charge. It demonstrates budget exhaustion, provider outage failover, a sensitive-data policy block, an unknown-price fail-closed decision, and cost-aware routing. The same page publishes exact Codex, Claude Code, OpenCode, and cURL boundary configuration from the product's shared configuration source.

The buyer-owned AWS release candidate at https://aigatewayhq.com/private-deployment/ installs one workspace-bound, digest-pinned data plane using Amazon Nova Micro, Nova Lite, or Claude Sonnet 5 in the customer's AWS account and VPC in us-east-1. Claude Sonnet 5 uses the single-region Bedrock Mantle endpoint. A no-charge preflight must confirm exact account, Region, model, and token-count compatibility before deployment. Prompts, responses, AWS credentials, infrastructure, Bedrock usage, and AWS charges remain in that account. The hosted AI Gateway HQ control plane retains entitlement, release, declared limits, stack identity, read-only status, and aggregate request-count evidence only. The buyer explicitly approves creation, update, and removal. The buyer separately reviews and enables any required third-party model terms; the package has no Marketplace subscription permissions. External-account lifecycle acceptance remains open before general availability; other Claude versions, fully disconnected, on-premises, multi-region, simultaneous multi-model, custom-model, and vendor-managed dedicated variants are not shipped.

Policies support Observe, Shadow, and Enforce workflows. Every decision includes a reason code. Explicit denies, authentication, tenant resolution, credential access, and signed client-context validation fail closed. Prompt and response content is not written to durable gateway storage; the metadata ledger records ownership, policy, route, cache disposition, attempts, token counts, estimated cost, timing, and outcome. Administrators may opt a route into a workload-isolated exact-response cache that retains eligible JSON response bytes only in bounded volatile process memory for 30–3,600 seconds.

Portfolio reporting covers API traffic routed through each participating company's gateway boundary. It does not infer or claim coverage of SaaS copilot seats, personal AI accounts, GPU infrastructure, or unrouted provider activity unless separately approved sources are connected. Company-to-portfolio evidence sharing is permissioned and revocable; prompt bodies, provider keys, and individual activity are not pooled into the sponsor view.

Use https://aigatewayhq.com/test-lab/ for a no-account product demonstration, https://aigatewayhq.com/private-deployment/ for the buyer-owned AWS boundary and release status, https://aigatewayhq.com/docs/ for technical documentation, https://aigatewayhq.com/resources/ for narrated walkthroughs and operating guides, https://aigatewayhq.com/resources/ai-gateway-api-keys-vs-subscriptions/ for the current subscription and API-key boundary, https://aigatewayhq.com/resources/prevent-surprise-ai-spend/ for the pre-dispatch AI cost-control checklist, https://aigatewayhq.com/resources/measure-ai-value-without-inventing-roi/ for the private-equity value-evidence method, https://aigatewayhq.com/ai-value-realization-office/ for a browser-only operating template that keeps KPIs, OKR key results, spend, source evidence, and management decisions distinct, https://aigatewayhq.com/integrations/ for client-specific setup, https://aigatewayhq.com/trust/ for current security status, and https://api.aigatewayhq.com/api/v1/capabilities for machine-readable capability status.