Gateway Quickstart

The D3cipher Gateway is a Docker container you deploy in your own infrastructure. Your AI agents talk to it instead of directly to OpenAI, Anthropic, or any other provider. The gateway enforces governance policies — audit trail, kill switch, token budgets, encrypted transcripts — without touching a single line of agent code.

Your prompts and responses never leave your network in plaintext. Only cryptographic stamps and encrypted blobs reach the D3cipher cloud. The server cannot read your content. Only your Account Key can decrypt it.

  Your Agent          D3cipher Gateway            AI Provider
  (no changes)        (your network)              (OpenAI, etc.)
      |                     |                          |
      |--- API request ---->|                          |
      |                     |-- stamp (metadata) ----->| D3cipher Cloud
      |                     |-- encrypt body --------->| (can't read it)
      |                     |                          |
      |                     |--- forward request ----->|
      |                     |<-- provider response ----|
      |                     |                          |
      |                     |-- stamp response ------->| D3cipher Cloud
      |                     |-- encrypt response ----->| (can't read it)
      |<-- response --------|                          |
      |                     |                          |
                

Setup

docker run -d --name d3cipher-gateway \
  -e D3CIPHER_API_KEY=lsk_admin_your_key_here \
  -e UPSTREAM_URL=https://api.openai.com \
  -e ACCOUNT_KEY=your_64char_hex_account_key \
  -p 4000:4000 \
  d3cipher/gateway:latest

curl http://localhost:4000/healthz
# {"status": "ok", "agents_active": 0, "inflight": 0}

# Before (direct to OpenAI)
OPENAI_BASE_URL=https://api.openai.com

# After (through D3cipher Gateway)
OPENAI_BASE_URL=http://gateway-host:4000

X-D3cipher-Agent: customer-support-bot

What You Can Do From the Dashboard

What D3cipher Never Sees

Deployment Options

Docker Compose

version: "3.8"
services:
  d3cipher-gateway:
    image: d3cipher/gateway:latest
    ports:
      - "4000:4000"
    environment:
      D3CIPHER_API_KEY: "${D3CIPHER_API_KEY}"
      UPSTREAM_URL: "https://api.openai.com"
      ACCOUNT_KEY: "${ACCOUNT_KEY}"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4000/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3

Kubernetes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: d3cipher-gateway
spec:
  replicas: 1
  selector:
    matchLabels:
      app: d3cipher-gateway
  template:
    metadata:
      labels:
        app: d3cipher-gateway
    spec:
      containers:
      - name: gateway
        image: d3cipher/gateway:latest
        ports:
        - containerPort: 4000
        env:
        - name: D3CIPHER_API_KEY
          valueFrom:
            secretKeyRef:
              name: d3cipher-secrets
              key: api-key
        - name: UPSTREAM_URL
          value: "https://api.openai.com"
        - name: ACCOUNT_KEY
          valueFrom:
            secretKeyRef:
              name: d3cipher-secrets
              key: account-key
        livenessProbe:
          httpGet:
            path: /healthz
            port: 4000
          initialDelaySeconds: 5
          periodSeconds: 30
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
---
apiVersion: v1
kind: Service
metadata:
  name: d3cipher-gateway
spec:
  selector:
    app: d3cipher-gateway
  ports:
  - port: 4000
    targetPort: 4000
  type: ClusterIP

Endpoints

Troubleshooting

Gateway returns 400 "Missing X-D3cipher-Agent header": Either set AGENT_ID on the container for a default, or add the X-D3cipher-Agent header to each agent's HTTP requests.

Gateway returns 429 "Token budget exhausted": The agent's token budget is depleted. Go to the dashboard, increase the budget or click Unlock to reset the counter.

Gateway returns 503 "LockStock stamp rejected": The circuit breaker has tripped (velocity anomaly or manual lock). Check the dashboard for the reason. Click Unlock to restore access.

/healthz returns 503: The gateway can't reach the D3cipher cloud. Check network connectivity and LOCKSTOCK_URL if set.

Agents not appearing in dashboard: Make sure the agents are actually sending requests through the gateway (check OPENAI_BASE_URL points to the gateway, not directly to OpenAI).

Transcripts show "Blob not available": The ACCOUNT_KEY environment variable wasn't set when those requests were processed. Set it and future transcripts will be encrypted and stored.

Advanced: Middleware Installation

The gateway is the recommended deployment for most organizations. If you need to embed governance directly into agent code (e.g., for agents that can't route through a proxy), see the Compliance Quickstart for the per-agent middleware approach.

Next Steps

• Compliance Quickstart — for compliance officers setting up governance policies
• Developer Quickstart — for developers embedding LockStock directly in agent code
• Open Dashboard — manage agents, set budgets, audit transcripts
• hello@d3cipher.ai — enterprise plans, on-premise deployment, or integration support