Connecting to the Gateway

Configure client applications to send requests through the AI Gateway. The gateway API base URL is <GATEWAY_HOST>/pty/federated-guardrails/v1; the client library appends its endpoint path.

Every request must include the caller’s verified identity JWT in x-user-auth. The optional x-team-id header selects a profile according to the deployment’s routing configuration. For example, the sample policy routes cs-bot to simple-protection, dps-bot to dps-protection, dpsl-bot to dpsl-protection, sdc-bot to sdc-protection, and gai-bot to gai-protection; requests without a matching header use the configured default profile.

1. Set the Gateway URL and Identity Token

Obtain an access token from the identity provider configured for your gateway. Set the gateway host and token for the examples:

export GATEWAY_BASE_URL="https://<GATEWAY_HOST>/pty/federated-guardrails/v1"
export IDENTITY_TOKEN="<IDP_ACCESS_TOKEN>"
export TEAM_ID="cs-bot"

Do not use a PPC token response header as the identity header value unless that token is the JWT issued for the caller and trusted by the gateway’s IdP registry.

2. Send an OpenAI-Compatible Request

The OpenAI SDK sends the identity and profile headers with each request. The client api_key is not the upstream credential for the OpenAI configuration shown here; the gateway uses its configured upstream key.

import os

import httpx
from openai import OpenAI

client = OpenAI(
    base_url=os.environ["GATEWAY_BASE_URL"],
    api_key="unused",
    default_headers={
        "x-user-auth": os.environ["IDENTITY_TOKEN"],
        "x-team-id": os.environ["TEAM_ID"],
    },
    http_client=httpx.Client(),
)

reply = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello from the gateway."}],
)
print(reply.choices[0].message.content)

The OpenAI SDK appends /chat/completions to the configured base URL. To test without the SDK:

curl -X POST "${GATEWAY_BASE_URL}/chat/completions" \
  -H "Content-Type: application/json" \
  -H "x-user-auth: ${IDENTITY_TOKEN}" \
  -H "x-team-id: ${TEAM_ID}" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [{"role": "user", "content": "Hello from the gateway."}]
  }'

3. Send an Anthropic Request

Configure the gateway’s YAML policy with upstream.protocol: anthropic and the Anthropic upstream URL. The Anthropic SDK appends /v1/messages to the same gateway base URL.

Important: In the current gateway image, the Anthropic protocol forwards the client’s x-api-key upstream. Supply a valid Anthropic API key in the SDK; unlike the OpenAI example, a placeholder client key will not work.

import os

import httpx
from anthropic import Anthropic

client = Anthropic(
    base_url=os.environ["GATEWAY_BASE_URL"],
    api_key=os.environ["ANTHROPIC_API_KEY"],
    default_headers={
        "x-user-auth": os.environ["IDENTITY_TOKEN"],
        "x-team-id": os.environ["TEAM_ID"],
    },
    max_retries=0,
    http_client=httpx.Client(),
)

message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=512,
    messages=[{"role": "user", "content": "Hello from the gateway."}],
)
print(message.content[0].text)

To verify the connection, confirm that the SDK returns a response and that the gateway logs show the request being routed to the expected profile. Use a trusted CA certificate in production; do not disable TLS certificate verification.