Documentation / Resources / Configure

Add and manage Gateways

Choose an installable Gateway package, connect its Credentials, and make the connection available to Models.

A Gateway is the connection through which a logical Model reaches an inference service. The package supplies reviewed integration code and a data-driven setup contract. Installing it creates an ordinary tenant-managed connection Resource. The package never contains your secrets; the installed Resource binds stored Credentials that Constal reveals only to an authorized invocation.

Before you begin

Decide who pays the upstream provider. If the package needs a Credential, you can select one you already have or connect an account without leaving the Gateway wizard. For example, Codex Gateway can set up the Codex Device Flow provider and guide you through authorization inline. A platform-paid Gateway may require no tenant Credential. You need permission to create Resources and Credentials in the selected namespace.

Steps

  1. Open Resources → Gateways and choose Add Gateway.
  2. Select a reviewed package from the catalog. Its card identifies the service, management authority, and number of Credential bindings.
  3. Give the installation a stable lowercase ID and a readable display name.
  4. Complete any non-secret connection settings generated from the package schema.
  5. Select one compatible stored Credential for each required slot. The picker only shows Credentials created by the provider that the package expects.
  6. If none exists, choose Connect. Constal installs a zero-configuration managed Credential Provider when necessary, starts its guided authorization, saves the resulting Credential, selects it for the Gateway, and returns you to this step. Providers that require operator configuration must be installed before they can mint a Credential.
  7. Choose Add Gateway. Constal validates the exact package hash, settings, Credential slots, declared capabilities, and egress policy before creating the connection Resource.
  8. Create or update a logical Model to use this Gateway. Agents bind the Model; they do not bind provider transport code directly.

To bring private integration code, select Install a custom Gateway. Upload a ZIP or TAR.GZ, or provide a public HTTPS Git repository pinned to a full 40-character commit SHA. Constal builds and probes the immutable package, adds it to this tenant's private catalog, then returns you to the same configuration step.

Verify

The installed row should show the chosen display name and Tenant managed ownership. Open it and confirm its exact CRN, capability contract, Credential bindings, and allowed egress destination. Then configure a test Model, invoke it from an Agent, and inspect the Run journal for the logical Model plus the resolved Gateway.

Next steps

Read Gateways and Models for the architectural model, Build a custom Gateway for the package contract, or Set up Codex Gateway for the supported Codex path. Use scoped bindings when each customer or principal must resolve a different connection or Credential.