> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connect an AI gateway > Route Opal's AI model calls through your own Anthropic-compatible AI gateway. ## Overview If your organization routes model traffic through its own AI gateway, you can point Opal's AI features at it instead of at Anthropic or Bedrock directly. Every model call, from Paladin and from Opal's other AI features, then goes to your gateway with the key you give Opal. The gateway forwards it to Anthropic. > [!NOTE] > > AI gateways are currently in beta. Contact Opal support to enable them for your organization. If you self-host Opal, you need version `1.1252.0` or later. Some self-hosted versions label it **LLM gateway** instead of **AI gateway**. The setup is the same. Your gateway must: * Accept Anthropic's Messages API (`POST /v1/messages`), including streaming. * Pass Claude requests through to Anthropic. A gateway that translates requests to another provider, such as Bedrock or Vertex, drops settings Opal relies on. * Serve these Claude models under their Anthropic names: * `claude-sonnet-5-5` * `claude-opus-4-8` * `claude-sonnet-4-5` * `claude-haiku-4-5` * `claude-haiku-5-5` If the gateway fails, Opal's AI features fail with it. Opal never falls back to its own Anthropic account. ## Supported gateways Opal supports these gateways: | Gateway | Notes | | - | - | | [Cloudflare AI Gateway](https://docs.opal.dev/docs/paladin/ai-gateway-cloudflare.md) | Send the gateway's token in a `cf-aig-authorization` header. | | [LiteLLM](https://docs.opal.dev/docs/paladin/ai-gateway-litellm.md) | Route Claude models to Anthropic, not to Bedrock or Vertex. The setup page explains why. | | [Bifrost](https://docs.opal.dev/docs/paladin/ai-gateway-bifrost.md) | Needs a virtual key scoped to Anthropic, with every model listed. | Other gateways aren't officially supported. If one meets the requirements above, the connection check shows whether it works before anything is saved. ## Connect your gateway **1. Open the AI gateway integration** Go to **Configuration** > **Productivity Integrations**. In the **AI** section, select **Connect** next to **AI gateway**. **2. Enter the gateway's URL and key** * **Gateway URL** is the gateway's Anthropic-compatible base URL, without `/v1/messages`. For example, `https://llm.example.com` or `https://llm.example.com/anthropic`. On Opal cloud it must use HTTPS. * **Gateway key** is the key Opal sends in the `x-api-key` header. Use a key made for Opal, such as a LiteLLM virtual key or a Bifrost virtual key, so you can limit and revoke it on its own. * **Headers** are optional. Add one only if your gateway needs an extra header on every request, such as a tenant or provider header. See [Headers](#headers). ![The Connect an AI gateway dialog, with Gateway URL and Gateway key fields, one header row, and a Check and save button.](https://mintcdn.com/opalsecurity/bnQkwrXs6LUXZqBX/images/docs/paladin-ai-gateway-connect.png?fit=max\&auto=format\&n=bnQkwrXs6LUXZqBX\&q=85\&s=7584bbc41e1a11b6d7c52937f488f099) Enter the gateway's URL and key, plus any headers it needs. **3. Check and save** Select **Check and save**. Opal sends small test requests through the gateway, then saves it only if every check passes. If something fails, fix it in your gateway and select **Check again**. **4. Select it as your provider** Go to **Configuration** > **Settings** > **AI Features**, and under **LLM Provider**, select **AI gateway - Your account**. The option stays disabled until a gateway is connected. The **AI gateway** tile under **Productivity Integrations** shows which host it's connected to. ## What the check tests The check sends a short request to every model Opal uses. Then, on the model Paladin uses for decisions, it tests each API feature Opal's AI features depend on: | Check | What it confirms | | - | - | | Models | The gateway serves each model under its Anthropic name. | | Streaming | Streamed responses work, and the gateway accepts Opal's prompt caching settings. | | Tools | Tool definitions reach the model. | | Thinking | The gateway accepts adaptive thinking. | | Effort | The effort setting reaches Anthropic. A gateway that drops it fails. | | Structured output | The gateway enforces the output schema. A gateway that only passes it as a hint fails, because OpalQuery and access review bucket labels depend on it. | Each failure says why it failed. When the gateway rejects a request, Opal shows the gateway's own short error message, such as a model that isn't allowed for the key. ![Check results in the Connect an AI gateway dialog: every model passes, Effort and Structured output fail with a red mark and a reason, and the button reads Check again.](https://mintcdn.com/opalsecurity/bnQkwrXs6LUXZqBX/images/docs/paladin-ai-gateway-check-failed.png?fit=max\&auto=format\&n=bnQkwrXs6LUXZqBX\&q=85\&s=2608fb1e8877c9ce3dbce87782f0b0e2) A gateway that drops the effort and structured output settings fails those checks, so Opal doesn't save it. ## Headers Some gateways need an extra header on every request. Add up to 10 under **Headers** when you connect. Opal sends them on the check and on every model call. * Header values are stored encrypted, with the gateway key. They're never shown again after you save. * You can set `Authorization` for a gateway that expects a Bearer token, or a gateway's own auth header, such as Cloudflare's `cf-aig-authorization`. ## Change or remove your gateway To change the URL, key, or headers, disconnect the gateway and connect it again. Opal won't disconnect the gateway while it's your LLM provider, so first select another provider under **AI Features**. ## Network access | Deployment | The gateway URL can reach | | - | - | | Opal cloud | Public addresses only, over HTTPS | | Self-hosted Opal | Addresses on your private network too, over HTTP or HTTPS | In both cases, Opal never connects to loopback, link-local, multicast, or cloud metadata addresses. It doesn't follow redirects, and it doesn't send gateway traffic through a proxy. On self-hosted Opal, also see [Set up Paladin on self-hosted Opal](https://docs.opal.dev/docs/paladin/self-hosted-setup.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.