From install to first request in five minutes.

The plugin, the router and the budget API, all in one place.

Docs preview. Getting started is below. The reference underneath covers authentication and billing; the router, virtual keys, Feature Costing and Model Lock references are being written.

Getting started

Three steps from an empty org to a governed first request.

Step 1Vault a provider key

Add an Anthropic, OpenAI, Bedrock or Azure key to the org vault. It stays server-side, so nothing lands in a developer .env.

Admin → Provider keys

Step 2Install the VS Code plugin

Engineers sign in with GitHub and get a scoped virtual key. No API key is ever pasted into the IDE.

Step 3Point your client at the gateway

The router is OpenAI-compatible, so the base URL is the only change. Budgets and Model Lock apply from the first request.

base_url = https://<your-host>/v1

Authentication

Email and password sign-in, session rotation, and password reset.

Method	Path	Description	Auth
GET	/api/auth/providers	Which SSO providers this deployment has credentials for.	Public
POST	/api/auth/signup	Create an account and start a session.	Public
POST	/api/auth/login	Exchange credentials for an access token.	Public
POST	/api/auth/refresh	Rotate the refresh cookie and mint a new access token.	Public
POST	/api/auth/logout	Revoke the presented refresh session.	Public
GET	/api/auth/me	Current user, plan and entitlements.	Bearer
POST	/api/auth/forgot-password	Request a reset link. Always answers 200.	Public
POST	/api/auth/reset-password	Consume a reset link and sign in.	Public

OAuth

Authorization-code flow with PKCE. Google, GitHub, Apple and Microsoft.

Method	Path	Description	Auth
GET	/api/auth/oauth/{provider}/start	Begin sign-in; redirects to the provider.	Public
GET	/api/auth/oauth/{provider}/callback	Provider redirect target. Establishes the session.	Public

Account

Profile, password, and session management for the signed-in user.

Method	Path	Description	Auth
GET	/api/account	Profile, linked providers and active sessions.	Bearer
PATCH	/api/account/profile	Update display name and avatar.	Bearer
POST	/api/account/password	Change the password and revoke other sessions.	Bearer
GET	/api/account/sessions	List live sessions.	Bearer
POST	/api/account/sessions/revoke	Revoke one session.	Bearer
POST	/api/account/sessions/revoke-all	Sign out everywhere, then back in here.	Bearer
GET	/api/account/activity	Recent authentication events.	Bearer

Billing

Plan catalogue, inline checkout, and the Stripe billing portal.

Method	Path	Description	Auth
GET	/api/billing/plans	Public plan catalogue, including the annual price.	Public
GET	/api/billing/config	Publishable key, fetched just before checkout.	Public
POST	/api/billing/checkout	Create the intent behind an inline Payment Element.	Bearer
POST	/api/billing/checkout/confirm	Reconcile after the client confirms, reading back from Stripe.	Bearer
GET	/api/billing/subscription	Current plan, add-ons, entitlements and payment history.	Bearer
POST	/api/billing/addons	Buy or stop an add-on on the active subscription, prorated.	Bearer
POST	/api/billing/portal	Open the hosted billing portal.	Bearer
POST	/api/billing/cancel	Cancel at the end of the current period.	Bearer

Platform

Health probes and the webhook receiver.

Method	Path	Description	Auth
GET	/api/health	Shallow liveness check.	Public
GET	/api/health/ready	Deep check that the database answers.	Public
POST	/api/webhooks/stripe	Signature-verified, idempotent Stripe webhook receiver.	Public
GET	/api/dashboard	One payload for the whole dashboard screen.	Bearer

Authenticating a request

Every authenticated call takes a short-lived bearer token. Verifying it is a signature check and touches no tables, which is why a request costs the same whether you have one user or a million.

curl https://your-host/api/auth/me \
-H "Authorization: Bearer $TOKEN"

Caching

Readable endpoints return an ETag. Send it back as If-None-Match and an unchanged resource answers 304 with an empty body.

# first request
200 ETag: "31fa9584…"
# revalidate
304 0 bytes

Every response carries Server-Timing and an X-Request-Id, so latency is visible from the browser and traceable in the logs.