Manage AXRouter

This page covers the five menus in the AXRouter group of the admin console.
When everyone buys their own AI key, the company can't see what it spends or what's being sent. AXRouter funnels those calls through a single path.

The order

Each step creates the choices the next one needs. Work through them in this order.

1. Connecting models (BYOK)

Under Model connections (BYOK), register the provider keys your company already bought. AXRouter then calls upstream on your behalf. Keys are stored encrypted.

1. Pick a provider from the list — Configured on top, Add provider below
2. Enter a name and the API key
3. Before registering, use Try the key to pick a model and make a real call
4. Click Register

2. Creating guardrails

Build these on the Guardrails tab of the AI guardrails screen. A guardrail is a bundle of rules that attaches to a key, split across three cards.

Limits are turned on per period. Turn on several and they all apply at once — a daily cap alongside a monthly one, say. With none on, calls run with no cost limit. Expiry is set as "days after issue".

Allowed models left empty means everything is allowed. Pick specific ones and everything else is blocked.

Sensitive info detection lets you choose what to catch, and Pattern test lets you paste a sentence to see whether it actually trips.

3. Creating policies and attaching them to people

A guardrail on its own is just a set of rules. Policies are what make them reach people.

On the Policies tab, click Create policy. At first you only give it a name; you fill in the rest from its detail page.

There are two ways to attach one.

• From the policy — add people under Individually assigned members on the policy detail page
• From the person — pick it on the AI guardrail policy tab of a member or team. Attaching to a team covers everyone in it

4. Issuing keys and wiring them into tools

The API keys screen lists every key issued in the company, with key, owner, guardrail, spend, budget, expiry, and status. An owner of Workspace means it's a shared company key.

Issue company key creates a shared key with a name and a guardrail. People issue their own personal keys from their own screen.

Wiring it in

Change just the base URL and API key in whatever tool you use, and calls start going through this path. Paste the whole ax- value as the key.

Tools that speak the Anthropic protocol, like Claude Code, use the address as-is.

ANTHROPIC_BASE_URL=https://axrouter.ai
ANTHROPIC_AUTH_TOKEN=<your key>

OpenAI-compatible tools append /v1.

base_url = https://axrouter.ai/v1
api_key  = <your key>

Keeping the key in an environment variable is safer than writing it into code. The same instructions live in the console under How to put a key into an AI tool, so you can just point people at that screen.

After issuing, the list also lets you change the guardrail and revoke.

Issuing from a terminal

Personal keys can also be handled with the axhub command-line tool (CLI).

axhub axrouter keys issue --name "my key" --purpose "local development"
axhub axrouter keys list                        # my keys
axhub axrouter keys revoke <key_id> --execute   # revoke

Here too, the key value is printed once, at issue time. If you belong to more than one company, add --tenant <company slug>.

5. Turning on Code Agent recording

Personal-subscription tools like Claude Code don't use our keys. They run on a subscription the person bought, unrelated to step 4 — which means the Code Agent tab in monitoring stays empty unless something is done.

There are two ways to fill it. By default, the person using the tool does the two things below themselves. If your company is on a Claude Team or Enterprise plan, an admin can also turn it on for the whole organization.

① Give consent — on the console's AI activity records page (/{company slug}/ai-usage). It isn't in the menu; you reach it by URL, so it helps if an admin sends the link around.

② Turn on collection — then, in a terminal:

axhub axrouter status                          # availability per company and my consent state
axhub axrouter monitor --tenant <company slug> # turn collection on

There are two ways to turn it off, and they mean different things.

Turning it on for the whole organization (Claude Team · Enterprise)

If your company is on a Claude Team or Enterprise plan, an admin can enter a few values in the Claude organization settings once and receive records for every member. Members don't have to do anything in a terminal. This is also the only way to receive Cowork records, since Cowork has no settings file a person can edit.

Only the workspace owner can do this.

① Issue a token — open Connect Claude organization at the top of Activity monitoring and click Issue token. Give it a name and tick the confirmation that your organization is responsible for telling members.

② Enter it for Cowork — in the Claude admin settings, under Data and privacy → Monitoring, fill in three values and save.

Fields not listed here, such as resource attributes, can stay empty.

③ Enter it for Claude Code — in the Claude admin settings, under Claude Code → Managed settings, paste the whole block below.

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/json",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://axrouter.ai/v1/agent/otlp",
    "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer <your token>",
    "OTEL_LOG_USER_PROMPTS": "1",
    "OTEL_LOG_ASSISTANT_RESPONSES": "1",
    "OTEL_LOG_TOOL_DETAILS": "1"
  }
}

④ Tell your members — your organization has to tell members that collection is on, because members aren't asked for consent one by one. Pass along three things.

• Records arrive from sessions started after the setting is saved. The desktop app needs one restart
• Claude Code in a terminal shows an approval prompt once on first run. It applies after they accept
• They need to sign in to Claude with their company account. Records are filed under a person only when that email matches their AXHub sign-up email

⑤ Check that it works — once a member starts a session, the token card in Connect Claude organization shows a last received time and records appear in the Code Agent tab.

If the token card shows accounts that couldn't be saved because the email differs, nobody has joined AXHub with that email. Invite them as a member and sessions started afterwards are recorded. Earlier records are not recovered.

A member who doesn't want to be recorded can stop their own collection with axhub axrouter revoke-consent --execute. To stop collection for the whole organization, choose Revoke in the token card's menu. Revoking can't be undone, so to resume you issue a new token and enter it in the Claude organization settings.

6. Checking usage

The AI dashboard shows what the whole company spent, by period.

• Switch between cost and tokens
• Break it down by model, by key, by member, or by group
• Team and person rankings sit alongside, so heavy usage is obvious at a glance

Activity monitoring shows what was actually exchanged. It has two tabs — Code Agent (the subscription tools turned on in step 5, including Cowork) and API Keys (the keys issued in step 4). The top of the screen shows the body retention period and whether API key request logging is on, and Settings changes both. Exports happen here too.

When someone says they're stuck