Gateway API keys

Connect OpenAI and Anthropic clients to Harriet with an API key. Use your organization's available models, usage reporting, and managed-spend budgets without enrolling a computer.

Create and manage a key

API keys are available when enabled for your organization. Creating and managing them requires both provisioner configuration and API-key management permissions. In the Endpoint AI console, open Organization → API keys and select Add API key.

1. Name the key

   Enter a key name describing the client or workload.

2. Choose when it expires

   Select 30, 90, or 365 days where your expiry rules permit, or a custom date. No expiry appears only when your rules allow it.

3. Set access and limits

   Optionally set requests per minute, concurrent requests, and allowed model IDs. A blank model list inherits your model access.

4. Optionally set a budget

   Turn on Set a budget for this key to cap what this key alone can spend. See Key budgets.

5. Create and copy the key

   Select Create key. Copy the key into your client's secret settings before you select Done. Harriet cannot show it again.

A key acts as the admin who creates it. It inherits that person's teams and applicable budgets and adds no seat. The table shows each key's status, last use, expiry, total requests, recorded cost, and budget. Last use can lag by five minutes. To rotate, create a replacement, update your clients, then choose Revoke key from the old key's menu. Revocation, expiry, and owner deactivation reject subsequent requests; they do not cancel a response already in progress. Revoked keys leave the table and appear under Revoked keys at the bottom of the page for 90 days.

Expiry rules, below the table, set the longest lifetime a new key can have and whether keys may never expire. They apply to keys created after you save them.

Key budgets

A key budget limits one key's managed spend per month or week. It sits on top of the owner's own user, team, and organization budgets, and the key's usage still counts toward those. Set it when you create the key, or later with Add budget or Edit budget on the key's row. Key budgets also appear in Usage & spend → Budgets under the key's name, with their alert history.

• Warn only: requests continue. Alerts are sent at the threshold and when the budget is exceeded.
• Soft block: requests continue, and responses carry the X-Harriet-Budget-Exceeded: soft header.
• Hard block: requests with this key return 429 with the error code budget_exceeded until the next period or until you raise the budget. The owner's other keys and apps keep working.

Alerts go to the key's owner and to everyone who can manage budgets. Key budgets can't be raised through a budget request; edit the key's budget instead.

Connect your client

Copy the base URL from Connect a client. The standard Anthropic base URL is https://harriethq.com/provisioner/llm-proxy. OpenAI clients append /v1. Use your gateway key, rather than an upstream provider key.

# Anthropic SDK or Claude Code
export ANTHROPIC_BASE_URL="https://harriethq.com/provisioner/llm-proxy"
export ANTHROPIC_API_KEY="YOUR_API_KEY"

# Discover the exact model IDs available to this key
curl https://harriethq.com/provisioner/llm-proxy/v1/models \
  -H "Authorization: Bearer $ANTHROPIC_API_KEY"

from openai import OpenAI
client = OpenAI(
    base_url="https://harriethq.com/provisioner/llm-proxy/v1",
    api_key="YOUR_API_KEY",
)
response = client.chat.completions.create(
    model="claude-sonnet-5-5",
    messages=[{"role": "user", "content": "Explain this invoice."}],
    stream=True,
)

To use the Codex CLI, add Harriet as a provider in ~/.codex/config.toml, export your key as HARRIET_API_KEY, and run a prompt with codex exec. Codex needs the Responses API, which the gateway offers for OpenAI models only. The http_headers line labels this traffic as Codex in usage reports.

model = "gpt-6.1-sol"
model_provider = "harriet"

[model_providers.harriet]
name = "Harriet"
base_url = "https://harriethq.com/provisioner/llm-proxy/v1"
env_key = "HARRIET_API_KEY"
wire_api = "responses"
http_headers = { "X-Harriet-Surface" = "codex" }

export HARRIET_API_KEY="YOUR_API_KEY"
codex exec --skip-git-repo-check "Reply with one word: Payroll, Leave or Benefits. How many vacation days do I have left this year?"

For Cursor, open Settings → Models, add your key as the OpenAI API key, and override the OpenAI base URL with the OpenAI base URL above. Then choose Add Custom Model and enter a model ID. If Experimental Auto routing is available to your organization, enter harriet-auto; otherwise enter any ID returned by /models. Other OpenAI-compatible tools work the same way: use the same OpenAI base URL and a model returned by /models.

Select See available model IDs under any client's instructions in Connect a client to see the IDs your organization can use, with a button to copy each one. Availability depends on provider credentials, plan, model policy, and EU residency settings.

Supported requests and limits

Translated Chat Completions supports one completion and ordinary function tools. Structured outputs, strict tool schemas, token penalties, logit bias, seeds, and OpenAI reasoning-effort parameters return a clear unsupported-request error on translated models. Tool-search deferral is disabled. Thinking and sampling parameters may be normalized for the chosen model. Gemini conversations sharing one key can collide on cached reasoning signatures during tool calls; use separate keys for concurrent Gemini workloads.

Streaming defaults to off. Use streaming for long generations: non-streaming requests time out after 25 seconds, and streams run for at most ten minutes. Defaults are 60 requests per minute and four concurrent requests per key. A 429 includes Retry-After; a 401 indicates invalid, revoked, expired, or disabled access. Limits are best effort during a Redis outage. Standard provider retention policies still apply; this API does not promise zero data retention.

For translated OpenAI requests, set max_completion_tokens or max_tokens explicitly if you need more than the default 4,096 output tokens. OpenAI metadata tags other than user_id are not forwarded to translated providers.

Experimental Auto routing

When enabled, harriet-auto, harriet-auto-fast, and harriet-auto-thorough select models with balanced, fast, or thorough preferences. Auto requires managed billing and the full model pool. It derives conversation identity from resent history; an optional X-Harriet-Session-Id helps separate conversations. Trimming early history can lose stickiness. Auto accepts text, base64 images, custom tools, and up to 64,000 output tokens.

Gateway Auto allows up to 922,000 estimated input tokens within a 1 million token context window, in both global and EU regions. This estimate includes conversation history, instructions, tools, images, and a safety margin, so the usable amount of prompt text is lower. The limit fits every model Auto may choose. Named models use their own provider limits. Large prompts take longer and may incur higher provider rates.

See Bring your own keys, Managed credits, and Budgets for billing behavior.