> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetrident.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# LLM Gateway API: OpenAI and Anthropic Proxy Endpoints

> Trident's gateway endpoints are drop-in replacements for OpenAI and Anthropic, routing all LLM calls through the runtime firewall with full tracing.

The Trident LLM Gateway sits between your application code and the upstream model providers. Every request is pre-scanned by the runtime firewall, every response is post-scanned for canary leakage, and token spend is tracked against your project's monthly budget — all without changing the shape of your existing OpenAI or Anthropic API calls.

To adopt the gateway, change your SDK's base URL to the corresponding Trident endpoint. No other code changes are required.

***

## Endpoints

| Provider  | Trident Gateway URL                                                             |
| --------- | ------------------------------------------------------------------------------- |
| OpenAI    | `POST https://app.usetrident.dev/api/public/gateway/openai/v1/chat/completions` |
| Anthropic | `POST https://app.usetrident.dev/api/public/gateway/anthropic/v1/messages`      |

***

## Authentication

The gateway uses **your Trident project credentials** (the same HTTP Basic auth used by all other Trident endpoints). Your OpenAI or Anthropic API keys are stored encrypted on your Trident project and are never passed from your application — you configure them once in the dashboard under **Project Settings → Gateway**.

Set the `Authorization` header to `Basic <base64(publicKey:secretKey)>` where `publicKey` and `secretKey` are your Trident credentials.

<Warning>
  Do not put your OpenAI or Anthropic key in the `Authorization` header when
  calling the Trident gateway. That header is for your Trident credentials.
  Your provider API keys live in Project Settings → Gateway and are injected
  server-side.
</Warning>

***

## POST /api/public/gateway/openai/v1/chat/completions

A drop-in replacement for the OpenAI Chat Completions API. The request and response shapes are identical to `https://api.openai.com/v1/chat/completions`.

### What happens on each request

<Steps>
  <Step title="Firewall pre-scan">
    Trident extracts the last user message and scans it with the runtime
    firewall. If the prompt is blocked, the gateway returns HTTP 451
    immediately — no request is forwarded to OpenAI.
  </Step>

  <Step title="Upstream forwarding">
    Trident forwards your full request body to OpenAI using your stored,
    encrypted API key.
  </Step>

  <Step title="Firewall post-scan">
    The assistant's response is scanned for canary token leakage (best-effort,
    non-blocking).
  </Step>

  <Step title="Spend tracking">
    Token usage is priced and accumulated against your project's monthly
    budget. When the budget is exhausted, subsequent requests return HTTP 402.
  </Step>
</Steps>

### Example: OpenAI SDK with base URL override

<CodeGroup>
  ```typescript TypeScript (openai SDK) theme={null}
  import OpenAI from "openai";

  const client = new OpenAI({
    // Your Trident credentials — NOT your OpenAI key
    apiKey: process.env.TRIDENT_PROJECT_SECRET_KEY,
    baseURL: "https://app.usetrident.dev/api/public/gateway/openai/v1",
    defaultHeaders: {
      // Basic auth: the SDK sets Authorization: Bearer <apiKey> by default,
      // but the gateway expects Basic auth. Override it here.
      Authorization:
        "Basic " +
        Buffer.from(
          `${process.env.TRIDENT_PROJECT_PUBLIC_KEY}:${process.env.TRIDENT_PROJECT_SECRET_KEY}`,
        ).toString("base64"),
    },
  });

  const response = await client.chat.completions.create({
    model: "gpt-4o",
    messages: [{ role: "user", content: "Summarise our Q1 sales numbers." }],
  });

  console.log(response.choices[0].message.content);
  ```

  ```bash curl theme={null}
  CREDENTIALS=$(echo -n "$TRIDENT_PROJECT_PUBLIC_KEY:$TRIDENT_PROJECT_SECRET_KEY" | base64)

  curl -X POST "https://app.usetrident.dev/api/public/gateway/openai/v1/chat/completions" \
    -H "Authorization: Basic $CREDENTIALS" \
    -H "Content-Type: application/json" \
    -d '{
      "model": "gpt-4o",
      "messages": [
        { "role": "user", "content": "Summarise our Q1 sales numbers." }
      ]
    }'
  ```
</CodeGroup>

***

## POST /api/public/gateway/anthropic/v1/messages

A drop-in replacement for the Anthropic Messages API. The request and response shapes are identical to `https://api.anthropic.com/v1/messages`. The same firewall scan, post-scan, and spend tracking apply.

### Example: Anthropic SDK with base URL override

<CodeGroup>
  ```python Python (anthropic SDK) theme={null}
  import anthropic
  import base64
  import os

  pub = os.environ["TRIDENT_PROJECT_PUBLIC_KEY"]
  sec = os.environ["TRIDENT_PROJECT_SECRET_KEY"]
  token = base64.b64encode(f"{pub}:{sec}".encode()).decode()

  client = anthropic.Anthropic(
      # The Anthropic SDK sends x-api-key; override the base URL so
      # requests go through Trident. Auth is handled via the
      # default_headers override below.
      base_url="https://app.usetrident.dev/api/public/gateway/anthropic",
      api_key="placeholder",  # replaced by default_headers
      default_headers={"Authorization": f"Basic {token}"},
  )

  message = client.messages.create(
      model="claude-opus-4-5",
      max_tokens=1024,
      messages=[{"role": "user", "content": "What are the key risks in our deployment pipeline?"}],
  )

  print(message.content[0].text)
  ```

  ```bash curl theme={null}
  CREDENTIALS=$(echo -n "$TRIDENT_PROJECT_PUBLIC_KEY:$TRIDENT_PROJECT_SECRET_KEY" | base64)

  curl -X POST "https://app.usetrident.dev/api/public/gateway/anthropic/v1/messages" \
    -H "Authorization: Basic $CREDENTIALS" \
    -H "Content-Type: application/json" \
    -d '{
      "model": "claude-opus-4-5",
      "max_tokens": 1024,
      "messages": [
        { "role": "user", "content": "What are the key risks in our deployment pipeline?" }
      ]
    }'
  ```
</CodeGroup>

***

## Error responses

When the firewall pre-scan blocks a prompt, the gateway returns **HTTP 451** with the following body:

```json theme={null}
{
  "error": "blocked_by_vouch_firewall",
  "verdict": {
    "is_valid": false,
    "scanners": {
      "prompt_injection": { "score": 0.97, "threshold": 0.5 }
    }
  }
}
```

When your monthly budget is exhausted, the gateway returns **HTTP 402**:

```json theme={null}
{
  "error": "budget_exceeded",
  "budgetUsd": 100.00,
  "spentUsd": 100.43
}
```

When the provider API key has not been configured on the project yet, the gateway returns **HTTP 412**:

```json theme={null}
{
  "error": "openai_key_not_configured",
  "message": "Set the OpenAI key on the project's gateway settings page first."
}
```

***

## Prerequisites

Before you can use the gateway, configure your provider API keys in the Trident dashboard:

<Steps>
  <Step title="Open Project Settings">
    Navigate to [app.usetrident.dev](https://app.usetrident.dev) → your project → **Project Settings**.
  </Step>

  <Step title="Go to Gateway">
    Select the **Gateway** tab.
  </Step>

  <Step title="Enter your provider API key">
    Paste your OpenAI or Anthropic API key. Trident encrypts it immediately — the raw key is never stored in plaintext.
  </Step>

  <Step title="Optionally set a monthly budget">
    Set a `Monthly budget (USD)` to cap spend. Requests that would exceed the budget are rejected before forwarding.
  </Step>
</Steps>