Beta: The LLM Gateway is in beta.
Prerequisites
- Your Organization admin has enabled the gateway and completed any required provider setup.
- You have a workspace-scoped LangSmith API key with
gateway:invokeandworkspaces:readpermissions. - For bring-your-own-key models, your workspace has the corresponding provider secret. Gateway Credits models do not require a provider secret.
Claude Code CLI
Claude Code supports two separate authentication methods. Choose one before configuring:- Workspace provider secret: The organization manages billing and policies through a provider key stored in workspace secrets. Use this method for org-managed usage.
- Claude subscription OAuth: Anthropic bills LLM calls to the user’s personal Claude Plus or Max subscription instead of the workspace provider secret, while LangSmith still enforces gateway permissions, policies, and tracing. Use this method when developers have their own subscriptions.
Use a workspace provider secret
SetANTHROPIC_API_KEY to your LangSmith API key. Claude Code reads these variables from your shell environment or from the env block in a settings file passed with --settings.
If your LangSmith deployment is on a regional or self-hosted instance, replace the gateway hostname in the examples below with your regional gateway hostname.
Use Anthropic models only
SetANTHROPIC_BASE_URL to the Anthropic-format gateway endpoint. The gateway infers the anthropic/ provider prefix from the endpoint.
Use a settings file (recommended)
YOUR_LANGSMITH_KEY_HERE with your LangSmith API key.
Use environment variables (fallback)
Route model tiers across providers
SetANTHROPIC_BASE_URL to the gateway root, then map each Claude model tier to a provider-prefixed gateway model ID.
Use a settings file (recommended)
YOUR_LANGSMITH_KEY_HERE with your LangSmith API key.
Use environment variables (fallback)
Use Claude subscription OAuth
Claude subscription OAuth requires an active Claude Code Plus or Max subscription. If you are using a workspace Anthropic API key, use the workspace provider secret method instead.
ANTHROPIC_API_KEY in workspace provider secrets.
Log in to Claude Code with your subscription, then configure the gateway.
Use a settings file (recommended)
Write the gateway configuration to a named settings file and pass it to Claude Code with--settings. This approach keeps your LangSmith API key out of your shell environment, shell history, and dotfiles:
YOUR_LANGSMITH_KEY_HERE with your LangSmith API key.
Use environment variables (fallback)
ANTHROPIC_CUSTOM_HEADERS value as a secret: it embeds your LangSmith API key, so keep it out of shell history, dotfiles, and shared configuration.
Claude Code uses and refreshes the OAuth credential from its saved login, including the required OAuth capability in the anthropic-beta header.
The LangSmith API key authenticates the gateway request and remains subject to gateway permissions and policies. The gateway forwards the OAuth bearer to Anthropic, so Anthropic bills the call to the user’s Claude subscription instead of the workspace provider secret. To confirm calls route through the gateway, check that traces appear in the gateway tracing project as described in Verify the setup.
Codex CLI
Codex uses the Responses API. Add the following to~/.codex/config.toml to call the hosted Kimi K3 model with Gateway Credits through the standard endpoint:
model with its provider-prefixed ID, such as openai/gpt-5.4-mini.
Gemini CLI
Gemini CLI sends Google’s native Generate Content requests, which the standard endpoint does not expose. Follow Direct model access to configure the/gemini route, then run:
Deep Agents Code
Use the OpenAI-compatible client with the standard endpoint, then pass the hosted model slug through theopenai integration:
openai:, for example, openai:anthropic/claude-opus-5. For provider-native integrations and model IDs, see Direct model access.
Company-wide deployment
For organizations rolling the gateway out to all developers, distribute the configuration through mobile device management or a shared shell profile. Distribute:- The standard gateway base URL for each client.
- A workspace-scoped LangSmith API key per user or team, depending on your policy granularity.
- The model IDs approved for each coding agent.
- The Codex
config.tomlif your organization uses Codex.
Verify the setup
After configuring a coding agent, make a test call and confirm that:- The call succeeds and the agent receives a response.
- A trace appears in the
gatewayorgateway-<short_api_key>-<api_key_id>tracing project in your LangSmith workspace.
403, check that your API key’s role includes gateway:invoke and workspaces:read. If a bring-your-own-key call fails with a 400 mentioning a missing provider key, ask your organization admin to add the provider’s key to workspace secrets.
Next steps
- Gateway Credits: call hosted models without a provider secret.
- Direct model access: configure provider-native routes for coding agents that require them.
- Spend policies: set cost limits on developer LLM usage.
- Traces, Engine, and access control: understand where gateway traces appear.
Connect these docs to Claude, VSCode, and more via MCP for real-time answers.

