The Trident gateway is a transparent proxy that sits between your agent and the LLM provider. Every request your agent makes passes through the gateway, which does two things simultaneously: it runs the runtime firewall to scan prompts and outputs for threats in real time, and it automatically captures the full trace — messages, tool calls, latency, and token counts — without any additional SDK instrumentation. For most teams, adding the gateway is the fastest path to complete runtime visibility and active threat blocking, requiring only a one-line base URL change.
Gateway endpoints
Replace your LLM provider’s base URL with the corresponding Trident gateway endpoint:
| Provider | Trident gateway endpoint |
|---|
| OpenAI | https://app.usetrident.dev/api/public/gateway/openai/v1 |
| Anthropic | https://app.usetrident.dev/api/public/gateway/anthropic/v1 |
Enable the gateway
Authenticate gateway requests using HTTP Basic auth with your Trident project key pair — the same publicKey:secretKey credentials you use for the REST API. Pass the Base64-encoded pair in the Authorization header. Optionally, include x-vouch-agent to tag which agent is making the request.
OpenAI — TypeScript
OpenAI — Python
Anthropic — TypeScript
Anthropic — Python
import OpenAI from 'openai';
const tridentAuth = Buffer.from(
`${process.env.TRIDENT_PROJECT_PUBLIC_KEY}:${process.env.TRIDENT_PROJECT_SECRET_KEY}`
).toString('base64');
const client = new OpenAI({
apiKey: 'trident-gateway',
baseURL: 'https://app.usetrident.dev/api/public/gateway/openai/v1',
defaultHeaders: {
'Authorization': `Basic ${tridentAuth}`,
'x-vouch-agent': 'my-agent-id',
},
});
import base64
import os
from openai import OpenAI
trident_auth = base64.b64encode(
f"{os.environ['TRIDENT_PROJECT_PUBLIC_KEY']}:{os.environ['TRIDENT_PROJECT_SECRET_KEY']}".encode()
).decode()
client = OpenAI(
api_key='trident-gateway',
base_url='https://app.usetrident.dev/api/public/gateway/openai/v1',
default_headers={
'Authorization': f'Basic {trident_auth}',
'x-vouch-agent': 'my-agent-id',
},
)
import Anthropic from '@anthropic-ai/sdk';
const tridentAuth = Buffer.from(
`${process.env.TRIDENT_PROJECT_PUBLIC_KEY}:${process.env.TRIDENT_PROJECT_SECRET_KEY}`
).toString('base64');
const client = new Anthropic({
apiKey: 'trident-gateway',
baseURL: 'https://app.usetrident.dev/api/public/gateway/anthropic/v1',
defaultHeaders: {
'Authorization': `Basic ${tridentAuth}`,
'x-vouch-agent': 'my-agent-id',
},
});
import base64
import os
import anthropic
trident_auth = base64.b64encode(
f"{os.environ['TRIDENT_PROJECT_PUBLIC_KEY']}:{os.environ['TRIDENT_PROJECT_SECRET_KEY']}".encode()
).decode()
client = anthropic.Anthropic(
api_key='trident-gateway',
base_url='https://app.usetrident.dev/api/public/gateway/anthropic/v1',
default_headers={
'Authorization': f'Basic {trident_auth}',
'x-vouch-agent': 'my-agent-id',
},
)
Required and optional headers
Pass these headers on every request to the gateway. Your HTTP client’s defaultHeaders (or equivalent) is the most convenient place to set them once.
| Header | Required | Description |
|---|
Authorization | Yes | HTTP Basic auth credentials. Encode your project key pair as Base64(publicKey:secretKey) and pass as Basic <encoded>. |
x-vouch-agent | No | An identifier for the specific agent making the request. Can be any string — use a stable, human-readable name like customer-support-agent. When set, traces and findings are scoped to that agent in the dashboard. |
Store your provider API keys
Before routing requests through the gateway, save your LLM provider API keys in Settings → Gateway. Trident encrypts and stores them server-side, then uses them to forward your requests to OpenAI or Anthropic. You never need to pass provider keys in gateway requests — Trident handles that automatically.
Blocked requests
When the firewall blocks a request, the gateway returns an HTTP 451 response instead of forwarding the call to the LLM provider. The response body is a JSON object:
{
"error": "blocked_by_vouch_firewall",
"verdict": {
"is_valid": false
}
}
451 responses from the gateway gracefully. Inspect the error field to distinguish a firewall block from a malformed request error (400) or an authentication failure (401).
Firewall scan modes
The gateway supports two scan modes:
| Mode | Latency overhead | How to enable |
|---|
| Fast (default) | ~10–50ms | Active by default for all projects |
| Full | ~150–300ms | Contact Trident support to enable |
Routing requests through the gateway adds latency to every LLM call your agent makes. Fast mode adds approximately 10–50ms; full mode adds approximately 150–300ms. Measure the impact on your agent’s end-to-end response time and factor it into your SLA planning before enabling the gateway in production.