Connect a client

Your client talks to Gatekeeper on your own machine, and Gatekeeper talks to the router only after the router's evidence checks out. Same OpenAI SDK, same model id, same key; only the base URL changes.

Before this page: an API key from API keys and a running Gatekeeper from Connect Gatekeeper.

The two base URLs

Direct works, and everything on this site about metering and billing is the same either way. What you give up without Gatekeeper is the only complete verification: your data is still protected, but you have no proof. Production traffic should go through it.

The snippets

These are the console's, as API Keys → How to connect prints them before a key exists. Replace sk-tee-v1-… with the key you copied and <model-id> with an id from Models; the console fills both in for you once you have a key.

Code examples
curlPythonNodeVS CodeOpenCode
shfrom the consoleCopy
curl http://127.0.0.1:8787/v1/chat/completions \  -H "Authorization: Bearer sk-tee-v1-…" \  -H "Content-Type: application/json" \  -d '{"model":"<model-id>","messages":[{"role":"user","content":"Hello"}]}'
pythonfrom the consoleCopy
from openai import OpenAIclient = OpenAI(    base_url="http://127.0.0.1:8787/v1",  # your local Gatekeeper    api_key="sk-tee-v1-…",)response = client.chat.completions.create(    model="<model-id>",    messages=[{"role": "user", "content": "Hello"}],)print(response.choices[0].message.content)
nodefrom the consoleCopy
import OpenAI from 'openai';const client = new OpenAI({  baseURL: 'http://127.0.0.1:8787/v1', // your local Gatekeeper  apiKey: 'sk-tee-v1-…',});const response = await client.chat.completions.create({  model: '<model-id>',  messages: [{ role: 'user', content: 'Hello' }],});console.log(response.choices[0].message.content);
jsonfrom the consoleCopy
[  {    "name": "Confidential Router",    "vendor": "customendpoint",    "apiKey": "sk-tee-v1-…",    "models": [      {        "id": "<model-id>",        "name": "<model-id>",        "url": "http://127.0.0.1:8787/v1/chat/completions",        "toolCalling": true,        "vision": false      }    ]  }]
jsonfrom the consoleCopy
{  "$schema": "https://opencode.ai/config.json",  "provider": {    "confidential-router": {      "npm": "@ai-sdk/openai-compatible",      "name": "Confidential Router",      "options": {        "baseURL": "http://127.0.0.1:8787/v1",        "apiKey": "sk-tee-v1-…"      },      "models": {        "<model-id>": {          "name": "<model-id>"        }      }    }  }}

The two file-based entries, VS Code and OpenCode, have a page of their own: IDEs and agents.

Keep the key out of your code

The official SDKs read OPENAI_API_KEY by default. Set it to your router key and omit api_key from the constructor; only the base URL stays in code.

shCopy
export OPENAI_API_KEY=sk-tee-v1-...

Streaming works unchanged: pass stream=True and read the chunks. The router forwards each chunk as it arrives and ends the stream with data: [DONE]. Details on Endpoints.

Which model id

The deployment publishes the models it serves at GET /v1/models, filtered to what your key may call. The console's Models screen shows the same list with context length and price per million tokens.

shCopy
curl http://127.0.0.1:8787/v1/models -H "Authorization: Bearer $OPENAI_API_KEY"

A model whose endpoint holds no verdict is absent from the list, not listed and broken.