Connect an SDK or AI tool
Configure supported AI clients, Codex, streaming, tools, and capture identity for Egress Gateway.
Use Connect a client to Gateway for copyable curl, OpenAI Python, OpenAI TypeScript and Anthropic Python examples. Shared Egress clients do not need Cortex Defender installed locally. The separate Defender Gateway path requires organization-managed configuration.
Before you begin
Required
- Client Gateway URL
Obtain the client-specific endpoint from your Gateway administrator.
- Enabled model ID
Use an exact model ID enabled for your organization. Review IDs in the Model catalog.
- Personal capture token
Follow Gateway credentials to obtain a personal
cct_token for the person or service account running the client. Store it in your approved secret manager.
Use that token wherever an example shows <CORTEX_API_KEY>. Provider API keys are separate organization-managed credentials used by Gateway for upstream calls.
Client-specific connection settings
| Client | Base URL value | Capture identity | Request notes |
|---|---|---|---|
| curl | The complete request URL issued by your organization | Authorization: Bearer $CORTEX_API_KEY, or X-Chaos-Capture-Token | Do not append a gateway path to a full request URL. |
| OpenAI Python or TypeScript | The issued SDK base ending in /gateway/v1 | Put your cct_ token in CORTEX_API_KEY and the SDK API-key field | Keep the compatible request shape. |
| Anthropic Python | The issued SDK base ending in /gateway | Put CORTEX_API_KEY in default_headers as X-Chaos-Capture-Token | The SDK's x-api-key alone does not carry capture identity. |
| Codex | The issued provider base ending in /gateway/v1 | Set X-Chaos-Capture-Token in http_headers | Use wire_api = "responses". |
Preserve the compatible request shape. Use the issued base as given instead of appending a Gateway path a second time.
Codex
- Add the provider configuration below to your local Codex configuration.
- Replace
<CORTEX_BASE_URL>with the issued SDK base, including/gateway/v1. - Replace
<CORTEX_API_KEY>with your personalcct_token. Keep this local configuration outside the repository. - Select an organization-enabled model in Codex, restart after changing configuration, and send a short test prompt.
Codex uses wire_api = "responses" and carries capture identity in X-Chaos-Capture-Token.
model_provider = "cortex"
[model_providers.cortex]
name = "Cortex Egress Gateway"
base_url = "<CORTEX_BASE_URL>"
wire_api = "responses"
http_headers = { "X-Chaos-Capture-Token" = "<CORTEX_API_KEY>" }Streaming, tools, and structured output
Ask your administrator which combination of client, model, provider and deployment supports the option you need. After a basic request succeeds, test streaming, tool calls and structured output separately using the API reference. A successful basic request does not confirm those options.
Verify and troubleshoot
- Confirm the client returns a successful provider response for the selected organization-enabled model.
- Record the client, model and test time. If Atlas is enabled, find the matching activity under the intended account in User profiles.
A response confirms forwarding for that request. Atlas is optional; Egress Gateway does not require an Atlas subscription. Captured activity is a separate verification step.
| Result | Next action |
|---|---|
| Capture identity is refused | Confirm the current personal cct_ token and the client's capture header. Anthropic's x-api-key alone does not carry capture identity. |
| Endpoint is unsupported | Confirm the complete curl URL or SDK base from the table above. Check for a duplicated Gateway path. |
| Model is unknown or provider is unconfigured | Confirm the enabled model ID and ask your administrator to check the provider connection. |
| Configuration changed but Codex still uses the old path | Restart Codex and begin a new test. |
| A response arrives but Atlas activity is missing | Confirm Atlas is enabled, the account is correct and the reporting range includes the test time. |
For response codes and retry guidance, use Errors and limits. To investigate budget, rate-limit or access refusals, use Troubleshoot refusals. Share the returned error and test time without credentials or private prompt text.
Ask your administrator whether Auto Router is enabled for your connection. Follow Inspect decisions and evaluate to compare recommendations with the model used.