Bring the client. Keep the routing policy here.

Use process-scoped values or an ephemeral config during testing. Never paste provider credentials into a client; clients receive only gateway-issued project keys, minted under API keys in the console. The administrator keys (LLMGW_API_KEY, LLMGW_API_KEYS) are for administration only: the data plane accepts them without key or project policy and quotas.

Claude Code

For normal use, merge these values into your private settings file and replace the placeholder with a gateway project key.

{
  "env": {
    "ANTHROPIC_BASE_URL": "http://127.0.0.1:8787",
    "ANTHROPIC_AUTH_TOKEN": "<GATEWAY_PROJECT_KEY>"
  }
}

On client versions supporting it, CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 in env enables gateway-backed model discovery for the picker. It changes discovery only, not translation, model capability, or account access. There is no implied Sonnet entitlement. Use an exact eligible model when the installed client lacks this toggle.

For a controlled API-key compatibility test:

export ANTHROPIC_BASE_URL=http://127.0.0.1:8787
export ANTHROPIC_API_KEY='<GATEWAY_PROJECT_KEY>'
claude --bare --model '<MODEL_SELECTOR>'

ANTHROPIC_AUTH_TOKEN supplies bearer auth instead. Claude settings may override process environment, so use per-invocation --settings when necessary.

Codex

model_provider = "llmgw"
model = "<MODEL_SELECTOR>"

[model_providers.llmgw]
name = "llm-gateway"
base_url = "http://127.0.0.1:8787/v1"
env_key = "LLMGW_PROJECT_KEY"
wire_api = "responses"
requires_openai_auth = false

Set LLMGW_PROJECT_KEY to a gateway-issued project key in the process. env_key may name any variable; avoid LLMGW_API_KEY, the gateway's administrator key variable. Built-in tools, reasoning summaries, encrypted state, and non-empty include require a native Responses target.

GitHub Copilot CLI BYOK

export COPILOT_PROVIDER_BASE_URL=http://127.0.0.1:8787/v1
export COPILOT_PROVIDER_API_KEY='<GATEWAY_PROJECT_KEY>'
export COPILOT_MODEL='<CLIENT_MODEL_ENTRY>'
export COPILOT_PROVIDER_WIRE_MODEL='<MODEL_SELECTOR>'
export COPILOT_PROVIDER_WIRE_API=completions
copilot

Use responses only for a native Responses target. For a no-tool smoke, use --available-tools=__llmgw_no_tools__; an empty allowlist does not filter installed tools.

SDKs

export OPENAI_BASE_URL=http://127.0.0.1:8787/v1
export OPENAI_API_KEY='<GATEWAY_PROJECT_KEY>'

export ANTHROPIC_BASE_URL=http://127.0.0.1:8787
export ANTHROPIC_API_KEY='<GATEWAY_PROJECT_KEY>'

Model selection

Exact provider/model targets one model. An endpoint name runs an ordered chain. A bare provider-native alias is available only when one eligible exact target remains. Response model fields report what served.

If both auth headers are supplied, x-api-key wins; an invalid one is not rescued by a valid bearer token.

Compatibility confidence

Automated fixtures cover discovery, Chat/Responses/Messages envelopes, token counting, streaming terminals, tools, safe metadata, and errors. They do not certify every future installed client release. The real-provider gate also verifies the Claude picker, physical Ctrl+C, Codex Responses, Copilot BYOK, usage attribution, and key revocation.