For Platform & Engineering
Your agents can spend without a ceiling. You shouldn't have to rewrite them to add one.
Change one base URL. Keep your SDK, your prompts, your framework. Budgets, PII pre-flight, signed identity, and audit land on every call — enforced at the gateway, before the model ever sees a token. No sidecar to run, no per-service refactor.
A Tuesday afternoon
Priya runs platform engineering. She had six services calling four providers, and no ceiling on any of them.
9:15 AM
A staging agent gets stuck in a retry loop.
It burns $2,100 in an hour before anyone looks at the dashboard. To put a hard cap in, Priya would have to touch every service and every key by hand.
2:00 PM — the swap
One env var per service. That's the whole migration.
ANTHROPIC_BASE_URL points at the gateway; the key becomes a tk_live_virtual key with a budget. The SDK doesn't know the difference.
The next loop
The same runaway agent stops itself.
The over-budget call returns 402 would_exceed_budget before it spends, and the attempt is one row in the ledger — tagged to the service, the model, and the task.
What becomes true
Governance you didn't have to build.
One base-URL swap and your SDK is unchanged — Anthropic, OpenAI, Gemini, Azure, and Bedrock behind a single governed endpoint.
A runaway agent gets a 402 before it spends, not a five-figure surprise on the invoice.
PII pre-flight, a binding-key second factor, and append-only audit run on every call — you didn't write any of it.
Bring your own provider keys, rotate in one place, and let semantic caching cut the bill without touching a prompt.
How it actually works
Swap the base URL. Keep the SDK.
The gateway speaks each provider's wire format, so your existing client is unchanged. It resolves the virtual key, checks the budget and PII before the upstream call, proxies to the provider with your real key, then commits the actual spend to the ledger — with an X-Acc-Spend header on the way back.
# Before — your app today
ANTHROPIC_BASE_URL=https://api.anthropic.com
ANTHROPIC_API_KEY=sk-ant-...
# After — same SDK, one URL, a governed key
ANTHROPIC_BASE_URL=https://gw.tokenality.ai/v1/anthropic
ANTHROPIC_API_KEY=tk_live_...
# Over budget? It stops before it spends:
# HTTP 402 { "error": "would_exceed_budget" }
# Leaked token, no binding key? A dead key:
# HTTP 401 { "error": "binding_required" }Want to see it fire? The live playground gives you a real budget-capped key: run a governed call, watch the ledger fill, hit the 402 wall, and watch PII get blocked — no signup.
It slots into the stack you already run.
Bring your own provider keys and your own observability backend. The gateway is the thin governed layer in between — nothing else about your architecture changes.
Anthropic
Native proxy — point ANTHROPIC_BASE_URL at the gateway
OpenAI / Azure OpenAI
Governed via the OpenAI-compatible surface
Google Gemini
OpenAI-compat proxy — live-verified in prod
AWS Bedrock
Converse API behind the same gateway, streaming cache included
Grafana / Honeycomb / Sentry
OpenTelemetry spans exported to your backend
Clerk
SSO + org isolation; identity signed into every key
Redis + Postgres / Neon
Nonce + rate-limit cache and the append-only Token Ledger
MCP gateway
Per-tool budgets + PKCE consent for the agent surface
1,900+ models
Pass-through routing when you need the long tail
You ship it. Four other people live in it.
The same ledger row answers Finance, People, Projects, and Security. Pick the door that matches the meeting you're in.
Frequently asked questions
How do I add Tokenality to my app?+
Change one base URL. The gateway accepts each provider's native wire format, so your existing SDK code works unchanged — you point it at Tokenality instead of the provider, and every call gets identity, a budget, PII pre-flight, and audit. No per-app rewrite.
Do I have to change my SDK or rewrite my calls?+
No. Because the gateway speaks the provider's native format (Anthropic, OpenAI, Gemini, and others), your client library and request/response shapes stay the same. The only change is the base URL and the key you use.
How long does it take to deploy?+
About 30 minutes for a Self-Hosted Starter on a cold start; 5 minutes for Hosted onboarding. Configuring allocation rules and PII policy at the same time typically pushes a full setup to 45–60 minutes.
How do I stop a runaway agent from overspending?+
Issue the agent a Virtual AI Key with a hard budget cap. The cap is enforced before the call is forwarded: when the balance is exhausted the gateway returns an HTTP 402 and no spend occurs. A loop that tries to burn $34,000 overnight stops at its $500 cap instead of alerting you the next morning.
Which models and providers are supported?+
Anthropic natively; OpenAI, Google Gemini, Azure OpenAI, and AWS Bedrock via a governed proxy; and 300+ more through OpenRouter and 1,600+ through LiteLLM pass-through — all behind the same key, budget, and audit envelope.