AgentGuard Managed quickstart

Install the SDK

# Node / TypeScript
npm install @agentguard-run/spend openai

# Python
pip install agentguard-spend openai

Set your license key

Your license key arrived by email after checkout (starts with ag_) and is also in dashboard settings. Provide it any one of three ways:

# A) CLI (saves it to ~/.agentguard, mode 600)
agentguard auth license-key ag_your_key_here
agentguard auth status          # confirm it is configured

# B) Environment variable
export AGENTGUARD_LICENSE_KEY=ag_your_key_here

# C) Pass it in code (shown in step 3 as licenseKey)

Point a client at OpenRouter and wrap it

On Managed you do not set an OpenRouter key. Construct any OpenAI-compatible client pointed at OpenRouter; the guard injects your managed key for OpenRouter calls automatically.

import OpenAI from 'openai';
import { withSpendGuardOpenRouter } from '@agentguard-run/spend/frameworks/openrouter';

// apiKey is a placeholder on Managed. The guard fetches and injects your
// short-lived managed key for the OpenRouter host, then caches it 15 minutes.
const client = new OpenAI({
  apiKey: 'managed',
  baseURL: 'https://openrouter.ai/api/v1',
});

const guarded = withSpendGuardOpenRouter(client, {
  licenseKey: process.env.AGENTGUARD_LICENSE_KEY,   // or omit if set via CLI
  policy: { caps: [{ amountCents: 2000, window: 'per_day', action: 'block' }] },
  scope: { tenantId: 'acme', agentId: 'support-bot' },
});

Make a governed call

Use the guarded client exactly like the native one. Every call is capped, capability gated, signed, and billed to your managed allowance. openrouter/auto routes to the cheapest capable model; name a specific model any time.

const res = await guarded.chat.completions.create({
  model: 'openrouter/auto',
  messages: [{ role: 'user', content: 'Draft a one line refund note.' }],
});

console.log(res.choices[0].message.content);
// Over your cap? The call throws AgentGuardBlockedError before OpenRouter is touched.

Verify a receipt

Every governed action signs a content-free receipt. Paste any receipt at agentguard.run/verify and confirm it yourself. It proves which model ran and that the call stayed in policy, never your data. Receipts stay verifiable at their URLs even if you cancel.