How your keys are actually handled.

Not a policy document — this is what the code does. Everything below is enforced in the request path, not promised in a PDF.

Agents never hold your provider key.

Each agent authenticates to Tollgate with a token Tollgate issues — never your real OpenAI or Anthropic key. The real key lives in Tollgate's vault and is only resolved server-side, at the moment a request is about to forward upstream.

agent → Authorization: Bearer tg_live_8f2…

tollgate → resolves agent, looks up vault

tollgate → openai → forwards with the real key

the real key is never returned to the agent

Encrypted at rest, verified on every use.

Stored provider keys are encrypted with AES-256-GCM, an authenticated cipher. A wrong encryption key or a tampered ciphertext fails the authenticity check outright — there's no silent fallback to a shared or default key if a stored one can't be verified.

→ decrypt org key

→ auth tag mismatch

→ 502 upstream_key_unavailable

fails closed — never falls back to another key

Agent tokens are hashed, not stored.

The token an agent authenticates with is SHA-256 hashed before it's ever written down. Tollgate looks agents up by that hash — the raw token isn't kept anywhere on our side once it's issued.

→ token issued, shown once

→ stored: sha256(token)

raw token: never persisted

Budget is checked before the request leaves.

The spend ceiling is compared against the current month's usage before a request forwards — not reconciled against an invoice afterward. Overspend is bounded by exactly one in-flight call, never a billing cycle.

Freezing takes effect on the very next request.

Freezing an agent flips one flag the proxy already reads on every request — no redeploy, no key rotation, no propagation delay to wait out.

Every request is logged — including the ones we deny.

Denied requests — a frozen agent, an exhausted budget — are recorded in the same audit log as allowed ones. If something is hammering a dead token or grinding against a budget, that shows up too, not just the traffic that got through.

What we haven't done yet.

We're early — there's no SOC 2 report or third-party penetration test to point to yet, and we'd rather say that plainly than imply otherwise. Everything above is true of the code running today; a formal audit is the next milestone, not a finished one. If your org can't take on that risk yet, self-hosting puts your keys on your own infrastructure instead of ours — send a note below.

Put a meter on your agents.

For larger fleets, custom limits, or self-hosting, send us a note below.