Skip to contentATP Token

How it works

On this page

The Gateway sits between your client and the upstream model providers. Every request flows through the same four stages, whichever SDK format you use.

The request path#

One request through the Gateway
  1. Your client
    `atp-…` keyOpenAI, Anthropic or Gemini format
  2. Authenticate
    key check401 if missing, disabled or expired
  3. Authorize the model
    project allowed list403 if the model isn't on it
  4. Route to a provider
    failoveron a provider error or timeout
  5. Meter and bill
    credits402 when the balance is exhausted
  6. Upstream provider
    never sees your ATP key
1

Authenticate#

The project API key is validated and then stripped before anything is forwarded upstream — providers never see your ATP key. Missing, disabled, or expired keys are rejected with 401. See Authentication.

2

Authorize the model#

The requested model must be on the project's allowed list. If it isn't, the request is rejected with 403 before reaching any provider — model access is enforced per project, not per key. See Models.

3

Route to a provider#

The Gateway picks a provider from the pool configured for that model and fails over to another on a provider error or timeout, so one model id stays stable across providers. See Provider routing & fallbacks.

4

Meter and bill#

Input and output tokens are metered and charged in credits against the project's balance. If the balance is exhausted the request is rejected with 402. See How credits work.

What the Gateway changes and what it doesn't#

The Gateway translates authentication and routing, but leaves your request and response bodies in the shape your SDK already expects.

Handled for youLeft unchanged
Key validation and provider authRequest body schema (per SDK format)
Model access checksResponse body schema
Provider selection and fallbackStreaming event sequence
Metering and credit deductionModel behavior and outputs

Because the wire formats pass through unchanged, migrating an existing OpenAI, Anthropic, or Gemini integration is usually just a base-URL and key change.

Go deeper on each stage#

Authentication

The three accepted key locations, and what a 401 actually means.

Model discovery

List what a project key may call before you hard-code a model id.

Provider routing

How a pool is ordered, and when the Gateway fails over to the next provider.

How credits work

What gets metered, and what happens when a project balance runs out.

Next steps

PreviousQuickstartNextAuthentication
Was this page helpful?