Last updated: September 22, 2026
Vault a model, then mint a Gateway key
Register each model as custom:your-model-id under Vault. Mint a kimss_ key under Keys. The provider key stays in Vault.
Paths: /app/vault and /app/keys. Never commit the Gateway key. Do not pip install kimss and do not add Maven com.kimss:kimss-java.
Point the client you already have
OpenAI clients use base_url https://api.kimss.ai/v1. Anthropic clients use https://api.kimss.ai with no /v1/messages suffix. Send X-Kimss-Agent-Id on every call.
Full snippets, including the prompt for Cursor, Cascade, and Claude Code, are on /docs/route_traffic. The agent fetches https://github.com/kimss-ai/kimss-control-plane.
Existing app
Keep the native SDK. Swap the base URL and the Gateway key.
New Python agent
pip install kimss-forge, then gateway="kimss" with your agent id and workspace key.
Guardrails
HTTP 451 means a policy fired after the route worked. See /docs/trust_safety.
What you pay for
Developer includes identity, audit, and kill switch. Production and above add Authority Boundary, Threat Intercepts, and team controls on the same hop.
Pricing is at /pricing. After the first governed call, the agent shows up under /app/agents.