Manage AXRouter

This page covers the five menus in the AXRouter group of the admin console.
When everyone buys their own AI key, the company can't see what it spends or what's being sent. AXRouter funnels those calls through a single path.

The order

Each step creates the choices the next one needs. Work through them in this order.

1. Connecting models (BYOK)

Under Model connections (BYOK), register the provider keys your company already bought. AXRouter then calls upstream on your behalf. Keys are stored encrypted.

1. Pick a provider from the list — Configured on top, Add provider below
2. Enter a name and the API key
3. Before registering, use Try the key to pick a model and make a real call
4. Click Register

2. Creating guardrails

Build these on the Guardrails tab of the AI guardrails screen. A guardrail is a bundle of rules that attaches to a key, split across three cards.

Limits are turned on per period. Turn on several and they all apply at once — a daily cap alongside a monthly one, say. With none on, calls run with no cost limit. Expiry is set as "days after issue".

Allowed models left empty means everything is allowed. Pick specific ones and everything else is blocked.

Sensitive info detection lets you choose what to catch, and Pattern test lets you paste a sentence to see whether it actually trips.

3. Creating policies and attaching them to people

A guardrail on its own is just a set of rules. Policies are what make them reach people.

On the Policies tab, click Create policy. At first you only give it a name; you fill in the rest from its detail page.

There are two ways to attach one.

• From the policy — add people under Individually assigned members on the policy detail page
• From the person — pick it on the AI guardrail policy tab of a member or team. Attaching to a team covers everyone in it

4. Issuing keys and wiring them into tools

The API keys screen lists every key issued in the company, with key, owner, guardrail, spend, budget, expiry, and status. An owner of Workspace means it's a shared company key.

Issue company key creates a shared key with a name and a guardrail. People issue their own personal keys from their own screen.

Wiring it in

Change just the base URL and API key in whatever tool you use, and calls start going through this path. Paste the whole ax- value as the key.

Tools that speak the Anthropic protocol, like Claude Code, use the address as-is.

ANTHROPIC_BASE_URL=https://axrouter.ai
ANTHROPIC_AUTH_TOKEN=<your key>

OpenAI-compatible tools append /v1.

base_url = https://axrouter.ai/v1
api_key  = <your key>

Keeping the key in an environment variable is safer than writing it into code. The same instructions live in the console under How to put a key into an AI tool, so you can just point people at that screen.

After issuing, the list also lets you change the guardrail and revoke.

Issuing from a terminal

Personal keys can also be handled with the axhub command-line tool (CLI).

axhub axrouter keys issue --name "my key" --purpose "local development"
axhub axrouter keys list                        # my keys
axhub axrouter keys revoke <key_id> --execute   # revoke

Here too, the key value is printed once, at issue time. If you belong to more than one company, add --tenant <company slug>.

5. Turning on Code Agent recording

Personal-subscription tools like Claude Code don't use our keys. They run on a subscription the person bought, unrelated to step 4 — which means the Code Agent tab in monitoring stays empty unless something is done.

To fill it, the person using the tool has to do two things themselves. An admin can't do it for them.

① Give consent — on the console's AI activity records page (/{company slug}/ai-usage). It isn't in the menu; you reach it by URL, so it helps if an admin sends the link around.

② Turn on collection — then, in a terminal:

axhub axrouter status                          # availability per company and my consent state
axhub axrouter monitor --tenant <company slug> # turn collection on

There are two ways to turn it off, and they mean different things.

6. Checking usage

The AI dashboard shows what the whole company spent, by period.

• Switch between cost and tokens
• Break it down by model, by key, by member, or by group
• Team and person rankings sit alongside, so heavy usage is obvious at a glance

Activity monitoring shows what was actually exchanged. It has two tabs — Code Agent (the personal-subscription tools turned on in step 5) and API Keys (the keys issued in step 4). The top of the screen shows the body retention period and whether API key request logging is on, and Settings changes both. Exports happen here too.

When someone says they're stuck