Gateway mode quickstart

Gateway mode is a drop-in base URL. Your code keeps using the provider's own SDK; Maskflare authenticates the request with your Maskflare key, masks personal data with your environment's rules, forwards it with the provider key stored in the console, and records the metadata (never the content) for the Traffic page.

1. Connect the provider

In the console open AI providers, pick the environment (Development, Staging or Production) and connect the provider with its API key. The key is encrypted and never shown again. If you'd rather keep provider keys in your application, choose pass-through: then send it as X-Maskflare-Provider-Key next to your Maskflare key.

2. Create an API key

Open API keys, choose Create key in the same environment, purpose Gateway. Copy the key (it starts with mf_); it is shown once.

3. Change the base URL

from openai import OpenAI

client = OpenAI(
    base_url="https://YOUR_GATEWAY_HOST/v1/openai",
    api_key="mf_live_...",  # your Maskflare key, not the OpenAI key
)
reply = client.chat.completions.create(
    model="gpt-5-mini",
    messages=[{"role": "user", "content": "Write to ada@example.com about her refund"}],
)
print(reply.choices[0].message.content)

import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({
  baseURL: "https://YOUR_GATEWAY_HOST/v1/anthropic",
  apiKey: process.env.MASKFLARE_API_KEY, // mf_live_...
});

curl https://YOUR_GATEWAY_HOST/v1/openai/chat/completions \
  -H "Authorization: Bearer mf_live_..." \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5-mini","messages":[{"role":"user","content":"Hello"}]}'

The key can travel in any header the provider's SDK already uses for its key (Authorization: Bearer, x-api-key, x-goog-api-key) or in X-Maskflare-Key. Each provider has its own base path:

4. Check it worked

Open Traffic: the request is there with its model, status, latency, tokens and how many values were masked per rule. The provider received mf_mask_... tokens in place of the values. To get the real values back in answers, turn on response restoration for the key (see tokens and re-hydration).