HTTP API Routes
Protect any REST or GraphQL API with SatGate's economic firewall — authentication, budget enforcement, and cost tracking for every request.
What are HTTP routes?
An HTTP route maps an incoming request path to an upstream API. SatGate acts as a reverse proxy — agents send requests to SatGate, which validates their token, tracks spend against their budget, and forwards the request to your upstream API.
This works for any HTTP API: OpenAI, Anthropic, internal microservices, third-party SaaS, or custom backends. If it speaks HTTP, SatGate can protect it.
HTTP Routes vs MCP Upstreams
- Traditional REST/GraphQL APIs
- Cost tracked per request
- You define routes explicitly (path → upstream)
- API keys and headers forwarded to upstream
- Works with any HTTP service
- AI tool servers (MCP protocol)
- Cost tracked per tool call
- Tools discovered automatically from upstream
- Supports SSE, Streamable HTTP, and stdio transports
- Works with Cursor, Claude, and MCP-compatible agents
Both use the same economic controls: macaroon tokens, budgets, enforcement modes, and delegation.
Adding a route
Navigate to Routes & Config in the dashboard. Click Add Route to create a new HTTP route.
Required fields
The URL path agents will call through SatGate. Example: /openai/
The base URL of the API you're protecting. Example: https://api.openai.com. Must be the base URL only — SatGate appends the request path.
Optional fields
If the upstream requires an API key, add it here. Keys are encrypted at rest (AES-256-GCM) and never visible to agents, other users, or SatGate staff. Only your gateway decrypts the key at runtime to inject it into the Authorization header on upstream requests. Your agents only need their SatGate capability token.
Additional headers to forward to the upstream (e.g., X-Custom-Header: value).
Remove the route path prefix before forwarding. If your route is /openai/ and strip prefix is enabled, a request to /openai/v1/chat/completions forwards as /v1/chat/completions.
Economic policy
Each route can have an economic policy that controls how agents are charged:
All traffic passes. Spend is logged but not enforced. Start here.
Budget enforcement active. Requests that would exceed an agent's budget are denied with HTTP 402 before reaching the upstream.
Per-request micropayments via Lightning Network. Full economic gating.
Example: Protecting OpenAI
A common use case is proxying OpenAI's API through SatGate so agents get budget-controlled access without seeing your OpenAI API key:
# Route configuration
path: /openai/
upstream: https://api.openai.com
stripPrefix: true # /openai/v1/chat/completions → /v1/chat/completions
apiKey: sk-proj-... # Your OpenAI key (stored encrypted)
# Economic policy
policy:
kind: control
pay:
mode: fiat402
enforceBudget: true
costCredits: 10 # 10 credits per request (50 budget = 5 calls)With this config, an agent calling /openai/v1/chat/completions through SatGate:
- Presents its SatGate capability token (macaroon)
- SatGate validates the token and checks the budget
- If budget allows, forwards the request to
https://api.openai.com/v1/chat/completionswith your API key - Deducts 10 credits from the agent's budget
- Returns the OpenAI response to the agent
Example: Internal microservice
# Route configuration
path: /api/internal/users/*
upstream: https://users-service.internal:8080
stripPrefix: true
# Economic policy
policy:
kind: observe # Shadow mode — log everything, block nothingKey differences from direct API access
| Feature | Direct API Access | Through SatGate |
|---|---|---|
| API keys | Shared with every agent | Stored in SatGate, never exposed |
| Budget control | None | Per-agent, per-route budgets |
| Audit trail | DIY logging | Automatic — every request logged |
| Revocation | Rotate API key (breaks all agents) | Revoke one agent's token instantly |
| Delegation | Not possible | Agents create scoped sub-agent tokens |
Tips
- Upstream URL must be base URL only —
https://api.openai.com, nothttps://api.openai.com/v1/chat. SatGate appends the request path. - Start with Observe mode — see real traffic patterns before enabling enforcement. The Shadow Report shows you exactly what would be blocked.
- Use strip prefix for clean routing — keeps your upstream URLs simple and lets you namespace routes by team or project.
- One API key per route — different routes can use different upstream keys. This is how you segment access to shared APIs.