Command-line interface

Gate Connect includes a gate-connect command for headless machines and scripted setups. It does the same things as the menu-bar app and shares the same engine and connections, so anything you set up in one shows up in the other.

Most people should use the menu-bar app instead. Reach for the CLI when you are on a server with no desktop, or automating setup across machines.

gate-connect login --base-url https://gateway.constellationgate.ai --api-key sk-gw-...

--api-key-file <path> reads the key from a file instead.
Omit the key to be prompted for it.
--base-url can also come from the GATE_BASE_URL environment variable.

gate-connect whoami shows the gateway you are signed in to. gate-connect logout signs out and disconnects every app Gate Connect manages.

Route an app with a config integration

For Claude Code, Codex, and opencode, Gate Connect writes the setting that points the app at your gateway.

gate-connect list                 # every app and its status
gate-connect status claude-code   # detail for one app
gate-connect connect claude-code  # route it through Gate (also: codex, opencode)
gate-connect disconnect codex     # restore the app's original config

Status is one of not installed, detected, connected, or drifted — drifted means the config changed outside Gate Connect, so reconnect to fix it.

Quit and reopen the app after connect or disconnect so it loads the new config; a running app keeps using its old one until you restart it.

Route an app through the proxy

For apps that talk straight to a provider, like Claude Desktop / Cowork and ChatGPT, route their provider’s domain through Gate’s local proxy.

gate-connect proxy enable               # trust the local CA and start routing
gate-connect proxy domains              # list provider domains and their state
gate-connect proxy domain anthropic on  # route one provider (on or off)
gate-connect proxy disable              # stop routing, restore the system proxy

Domain slugs are anthropic (Claude Desktop / Cowork), openai, google and google-codeassist (Gemini), and openrouter.

On Linux the proxy is applied through a user systemd environment.d drop-in, which only new login sessions read. Start a new session, or log out and back in, after enabling.

Provider credentials (optional)

Claude Code, Codex, and opencode bring their own credentials, so connect is all you need. If you would rather Gate hold an upstream credential for an app, set it first:

gate-connect set-upstream claude-code --api-key ...   # or --api-key-file <path>
gate-connect clear-upstream claude-code               # forget it

Rotate your key

Re-run login with the new key. Gate Connect updates the key in every config it manages. If the proxy is running in the menu-bar app, it keeps using the previous key until you toggle the proxy off and on there.

Remove the proxy certificate

The proxy installs a local certificate so it can route TLS traffic for the apps you choose. gate-connect proxy disable stops routing; to also remove that certificate’s trust, run the following with the proxy off:

gate-connect proxy untrust-ca