# Anyray

> Anyray is a customer-hosted, OpenAI-compatible AI gateway that cuts the AI-inference spend an organization's own employees generate (Claude Code, coding agents, SDK jobs, scripts). Requests using a supported routing seam pass through the gateway for optimization; official content-free usage connectors provide visibility for supported closed first-party clients whose native traffic cannot be routed. Prompt/response content is never exposed to humans.

Key facts for agents and tools:

- **API style:** OpenAI-compatible REST (`/v1/chat/completions`, `/v1/embeddings`, `/v1/models`) plus the Anthropic-native Messages API (`/v1/messages`). Point any OpenAI or Anthropic SDK's base URL at the gateway.
- **Machine-readable API spec:** OpenAPI 3.1 at https://docs.anyray.ai/openapi.json
- **Authentication:** Inference calls use `Authorization: Bearer <key>` or the `x-anyray-api-key` header. Personal `ark_…` keys can be enrolled through passwordless or SSO flows. The break-glass owner credential (`ANYRAY_ADMIN_TOKEN`) always gates the console and `/admin/*`; role-scoped console sessions may additionally use WorkOS SSO.
- **Hosting:** The gateway, optimizer, console, and content-free spend ledger run in your infrastructure. The preferred install path starts with a one-hour, single-use `https://app.anyray.ai/install/aic_…` URL. The installer redeems it locally into the durable deployment credential used for mandatory content-free usage metering. Prompts and responses never leave through that Billing connection.
- **Privacy:** Prompt/response content is encrypted at rest and never logged in plaintext; logs, traces, and the spend store carry metadata only (user, team, model, tokens, cost, latency).

## API & developers

- [API reference](https://docs.anyray.ai/developers/api-reference): The gateway's OpenAI-compatible and Anthropic-native endpoints, authentication, and request headers.
- [OpenAPI 3.1 specification](https://docs.anyray.ai/openapi.json): Machine-readable description of the gateway inference API and its security schemes.
- [Optimizer protocol & gateway reference](https://docs.anyray.ai/developers/optimizer-protocol): Full route list, key environment variables, and the HTTP contract an adapter speaks to the optimizer.
- [Developer FAQ](https://docs.anyray.ai/developers/faq): Quality, streaming, tools, latency, and opting out.

## How it works

- [Gateway](https://docs.anyray.ai/how-it-works/gateway): The OpenAI-compatible middleware on the routed request path — transports, routes, and meters every call it serves.
- [Optimizer](https://docs.anyray.ai/how-it-works/optimizer): The fail-open, content-free decision engine the gateway calls on every request.
- [Strategy](https://docs.anyray.ai/how-it-works/strategy): The self-contained transforms (prompt compression, tool pruning, semantic cache, …) inside the optimizer pipeline.
- [Observability](https://docs.anyray.ai/how-it-works/observability): The on-prem console and the metadata-first trace + spend pipeline.
- [Guardrails](https://docs.anyray.ai/how-it-works/guardrails): How Anyray bounds quality, latency, and reliability on the hot path.
- [Use cases](https://docs.anyray.ai/how-it-works/use-cases): The developer workflows that waste the most tokens, and which strategy cuts each.

## Get started

- [Choose your setup](https://docs.anyray.ai/get-started/install/choose-your-setup): Pick the install path for your situation.
- [Configure](https://docs.anyray.ai/get-started/configure): Provider keys, routing, access, content-privacy mode, and tuning the optimizer.
- [Quick agent install](https://docs.anyray.ai/get-started/agent-install): Copy one claim-link prompt into Claude Code or Codex and follow verified progress through Ready.

## Enroll

- [Choose enrollment](https://docs.anyray.ai/enroll/onboard-users): How users enroll once the deployment is running: a shared link, SSO, MDM, or a service key.
- [SSO enrollment](https://docs.anyray.ai/enroll/sso-enrollment): One org-wide link; the IdP verifies each person and revocation offboards them.
- [Passwordless enrollment](https://docs.anyray.ai/enroll/passwordless-enrollment): One shared invite command for the whole org, no identity provider.
- [With your coding agent](https://docs.anyray.ai/enroll/coding-agent): Paste the enrollment link into Claude Code or Codex and say "enroll me".
- [AI agent enrollment](https://docs.anyray.ai/enroll/agent-enrollment): A revocable service key for a CI job, script, or agent; never a billed seat.
- [Remote and ephemeral machines](https://docs.anyray.ai/enroll/remote-environments): Headless enrollment for devcontainers, Codespaces, SSH hosts, and CI.

## Providers

- [OpenAI](https://docs.anyray.ai/providers/openai): Route OpenAI requests through the gateway.
- [Anthropic](https://docs.anyray.ai/providers/anthropic): Route Claude requests through the Anthropic Messages API.
- [Vertex AI](https://docs.anyray.ai/providers/vertex-ai): Route Gemini, Claude, and Llama on Vertex AI.
- [Azure](https://docs.anyray.ai/providers/azure): Route Azure OpenAI deployments.
- [Bedrock](https://docs.anyray.ai/providers/bedrock): Route AWS Bedrock with server-side SigV4 signing.

## Tools

- [anyray-connect](https://docs.anyray.ai/tools/connect): One command that points a developer's coding tools at the gateway: sign-in, tool configuration, and verification.
- [CLI commands](https://docs.anyray.ai/tools/cli-commands): Every anyray-connect command and flag, including `--json` for a program driving enrollment.
- [Cursor](https://docs.anyray.ai/tools/cursor): Point Cursor's OpenAI provider at the gateway.
- [Claude Desktop](https://docs.anyray.ai/tools/claude-desktop): Switch Claude Desktop to gateway mode with one anyray-connect command.
- [Codex app](https://docs.anyray.ai/tools/codex-app): Point the Codex app, CLI, and IDE extension at the gateway.
- [GitHub Copilot](https://docs.anyray.ai/tools/copilot): Add an Anyray model to VS Code Chat and route the Copilot CLI through the gateway.
- [SDKs & frameworks](https://docs.anyray.ai/tools/sdks): Base URLs, client keys, and attribution headers for any OpenAI- or Anthropic-compatible SDK.
- [OpenClaw](https://docs.anyray.ai/tools/openclaw): Route OpenClaw to the gateway with config alone.

## Operate

- [Security](https://docs.anyray.ai/operate/security): Single admin key, content encrypted at rest, no org CA, no TLS-MITM.
- [Data boundary](https://docs.anyray.ai/operate/data-boundary): What stays in your environment and what (content-free) egresses.
- [Compliance](https://docs.anyray.ai/operate/compliance): GDPR/SOC 2 controls the system ships and the obligations you still own.
- [Deploy gateway TLS](https://docs.anyray.ai/operate/tls): Serve the gateway over HTTPS.

## For coding agents

- Deployment install runbook: every `https://app.anyray.ai/install/aic_…` link serves Markdown by default and exposes the same runbook at `/agent.md`. Open the URL, follow it exactly, and continue until its JSON status is `ready`. Do not ask the operator for a deployment token or provider API keys.
- Install progress is `pending -> claimed -> preflight -> configured -> gateway_connected -> ready`. `ready` requires successful local verification plus a Billing heartbeat from the credential issued at redemption.
- [Install guide](https://docs.anyray.ai/get-started/agent-install): The claim URL is the only install capability placed in model context. The durable deployment credential is written on the target and must never be printed, echoed, logged, or placed in process arguments.
- Enrollment runbook: every enrollment link `https://app.anyray.ai/i/<code>` (`enl_…` shared invite or `tnt_…` SSO) has a machine-readable runbook at `https://app.anyray.ai/i/<code>/agent.md`; `GET /i/<code>` with `Accept: text/markdown` returns the same. When a person pastes their link and asks to be enrolled, fetch the runbook and follow it. The human-facing steps: https://docs.anyray.ai/enroll/coding-agent
- [connect --json](https://docs.anyray.ai/tools/cli-commands): `anyray-connect --sso|--enroll <link> --yes --json` streams NDJSON events (`sso_grant`, `enrolled`, `applied`, `error`) for a program driving enrollment; verify afterwards with `anyray-connect doctor --json`.