Skip to main content

Connect a client

There are two endpoints you might connect a tool to, and they do different jobs.

The AI gateway is where model requests go. Point any OpenAI-compatible client at it and its model calls route through your organization's policies and count against your budget.

The MCP gateway is where tool calls go. Point any MCP client at it and it sees the connectors you have been granted, with upstream authorization brokered for you.

Most people connect both, and many tools need both configured separately.

Get the setup instructions​

The console generates per-client instructions with your deployment's real endpoints already filled in. Use those rather than transcribing addresses by hand.

  • Setup, under Connectors, covers pointing MCP clients at the MCP gateway.
  • Setup, under AI Gateway, covers routing a client's model calls through the AI gateway.

Both pages carry step-by-step instructions for common editors, agents, and command-line tools, and the MCP page additionally offers a copyable prompt you can paste into an AI-powered client to have it configure itself.

tip

These instructions live in the product rather than in this documentation on purpose. They interpolate your actual gateway addresses, which a documentation page can only show as a placeholder.

How you authenticate​

Two options, and the right one depends on whether a person is present.

Signing in is the default for interactive use. Your tool completes a browser sign-in against your corporate identity provider, and the resulting session identifies you to the gateways.

A virtual API key is for anything that cannot complete a browser flow: a script, a scheduled job, a continuous integration step. Create one under API keys and use it where a provider API key would go.

An API key is bound to your identity, not a shared service credential. Requests made with it are attributed to you, charged to your budget, and recorded against you in the audit trail. See Virtual API keys.

What to expect once connected​

Your model calls are checked against your budget before they are sent, so a request can be refused because you have run out rather than because anything is broken. Your tool calls only reach connectors your groups have been granted.

If a connector needs to reach a backend as you, it will ask you to sign in to that backend once, from your connector list. After that the gateway holds the authorization for your later calls.

Next steps​