Route Claude Code and Codex through an AI gateway: setup and caps

How do you route Claude Code through a gateway? Set ANTHROPIC_BASE_URL to the gateway and put a gateway credential in ANTHROPIC_AUTH_TOKEN (sent as Authorization: Bearer) or ANTHROPIC_API_KEY (sent as x-api-key)¹. Codex takes a custom model provider in ~/.codex/config.toml with base_url, env_key and wire_api = "responses"². Give every developer their own gateway key, and each one gets a spend limit, attributed usage and a clean offboarding.

Coding agents run long sessions with large contexts, and they run them for every engineer at once. That makes them one of the fastest-growing lines on many AI bills, and usually the least attributed one. This guide gives the exact configuration for both tools, then the controls worth putting on them.

Why put coding agents behind a gateway

Anthropic's own gateway page lists what one gives an organization: provider keys stay server-side while developers hold gateway credentials; usage is attributed per developer or team; budgets and rate limits are enforced in one place; every request is logged; and the provider can be changed in the gateway without touching developer machines³. It also states the trade-off: the gateway becomes infrastructure you operate, and it has to keep forwarding what new Claude Code releases send³.

One billing consequence is easy to miss. While a gateway credential or apiKeyHelper is active, a developer's claude.ai subscription limits do not apply to those requests; they are billed per token to whoever owns the credential the gateway forwards³. Moving a team onto a gateway moves its coding-agent cost from subscriptions to your API account, so plan the budget before the rollout, not after the first invoice. Coding agent costs for teams covers the numbers.

Claude Code: the configuration

export ANTHROPIC_BASE_URL="https://llm-gateway.example.com"
export ANTHROPIC_AUTH_TOKEN="gateway-key-for-this-developer"

The credential variable decides the header. ANTHROPIC_AUTH_TOKEN sends Authorization: Bearer; ANTHROPIC_API_KEY sends x-api-key; an apiKeyHelper command sends both. A credential in the variable the gateway does not read fails with 401, and Anthropic's advice when you were not told which kind you have is to start with ANTHROPIC_AUTH_TOKEN¹.

Shell exports last for one terminal. To make the settings apply everywhere Claude Code runs, including background agents, put them in the env block of ~/.claude/settings.json, and never in a project's committed .claude/settings.json¹:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://llm-gateway.example.com",
    "ANTHROPIC_AUTH_TOKEN": "gateway-key-for-this-developer",
    "ANTHROPIC_CUSTOM_HEADERS": "X-Team: payments"
  }
}

Then verify. Run /status: an Anthropic base URL line confirms the gateway address, and an Auth token or API key line confirms the gateway credential is active rather than a saved claude.ai login¹. Before that, a one-token curl to $ANTHROPIC_BASE_URL/v1/messages tells you whether a failure is the gateway or your configuration.

Useful extras from the same page:

• ANTHROPIC_CUSTOM_HEADERS adds headers such as a team or routing key, one Name: Value per line.
• CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 adds the gateway's model list to the /model picker.
• apiKeyHelper runs a command to fetch a rotating credential, cached for five minutes by default.
• CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 turns off version checks and telemetry outside the gateway path, at the cost of auto-updates¹.

Rolling it out to a team

Anthropic's rollout sequence is: give the gateway your provider credential, issue each developer a gateway credential, distribute the base URL and credential through managed settings and your secrets tooling, and have each developer check /status³. To make the gateway the only destination a managed machine may use, set allowedProviders to ["customEndpoint"] in the managed settings file with the gateway's ANTHROPIC_BASE_URL in its env block; Claude Code then refuses sessions pointed anywhere else (v2.1.285 or later)³.

Codex: the configuration

model = "gpt-6-sol"
model_provider = "gateway"

[model_providers.gateway]
name = "Company gateway"
base_url = "https://llm-gateway.example.com/v1"
env_key = "GATEWAY_API_KEY"
wire_api = "responses"
http_headers = { "X-Team" = "payments" }

The fields come from Codex's configuration reference: base_url is the provider's API base, env_key names the environment variable holding the key, http_headers adds fixed headers and env_http_headers adds headers from environment variables. wire_api accepts only responses, which is also the default. Codex retries failed HTTP requests four times by default (request_max_retries) and treats a stream idle for five minutes as failed (stream_idle_timeout_ms)². If your gateway also retries, lower one of the two so a provider error does not become a long stall.

The controls worth turning on

1. One key per developer, never a shared one. Usage is attributed to a person, a leaver is offboarded by revoking one credential, and a leaked key is contained to one seat.
2. A spend limit on every key. Coding agents can loop. A daily or monthly limit per key turns a runaway session into a refused request instead of a surprise. Bounding AI agent loops covers step and token limits inside the agent.
3. Attribution headers. A team or project header on every request lets you report cost per team without parsing anything.
4. A model allowlist. Decide which models agents may use. The most capable model is rarely needed for every turn, and an allowlist makes the choice deliberate.
5. MCP tool overhead. Every tool definition is input on every turn unless it is deferred; large MCP tool lists are a quiet multiplier on agent cost. MCP vs CLI token overhead measures it.

Failover: stay on Claude for Claude Code

Anthropic's gateway page is explicit that it does not support routing Claude Code to non-Claude models through any gateway³. A gateway may be able to translate the request, but the agent's behaviour depends on the model it was built for. For resilience, give Claude Code's traffic Claude targets on more than one provider — for example the Claude API and Claude on Google Cloud — rather than a fallback to another model family.

The errors you will meet first

Using INFRO as the gateway

INFRO answers Claude Code on POST /v1/messages in Anthropic's Messages shape and Codex on POST /v1/responses in OpenAI's Responses shape, so both tools work with the base URL and an INFRO gateway key: ANTHROPIC_BASE_URL=https://api.infro.io for Claude Code, base_url = "https://api.infro.io/v1" for Codex. On an Anthropic or Claude-on-Vertex connection the body Claude Code sends reaches the provider as written, including thinking blocks and cache_control breakpoints; set ENABLE_TOOL_SEARCH=true and MCP tools stay deferred. Each request runs on your own provider account, after your routes, allowlists and budgets; a key's spend limit refuses a request it cannot cover with 402 before the provider sees it, and the request log shows spend per key. X-INFRO-Workflow and the other attribution headers can be sent through ANTHROPIC_CUSTOM_HEADERS or Codex's http_headers.

Summary

Two settings per tool move coding agents onto a gateway. Do it with one key per developer, a spend limit on every key, attribution headers and managed settings that pin the destination, and keep Claude Code's failover between Claude providers.