Skip to content
Gate

Hermes

Route Hermes Agent through Gate to add prompt-injection scanning, audit, caching, and cost tracking. Your agent does not change. Hermes reaches Gate through a Custom endpoint provider configured in ~/.hermes/config.yaml. Create your Gate key (sk-gw-…) under API keys in the dashboard.

Pay through Gate

Drop the upstream headers and authenticate with your Gate key alone. Gate routes through your organization’s configured providers and bills pay-as-you-go. Run hermes model, choose Custom endpoint, and enter the base URL, your Gate key, and a model id — or set it directly:

model:
  provider: custom
  base_url: https://gateway.constellationgate.ai/v1
  default: anthropic/claude-opus-4-8
  api_mode: chat_completions
  api_key: sk-gw-…your Gate key…

The Gate key and model are placeholders. Use your own key (sk-gw-…) and any Gate-catalog model, written provider/model. Browse IDs on the dashboard’s Models page or via GET /v1/models.

Use your own keys

Keep your own provider key (OpenRouter shown here). Gate forwards it and adds its security and audit layer underneath. Hermes sends Gate’s headers through default_headers, which apply on the OpenAI wire (api_mode: chat_completions).

This covers any OpenAI-compatible upstream. An Anthropic key is the exception: Gate requires Claude traffic on the Anthropic /v1/messages wire, and Hermes does not send Gate’s headers on that wire — route a Claude key through Claude Code instead.

model:
  provider: custom
  base_url: https://gateway.constellationgate.ai/v1
  default: openrouter/auto
  api_mode: chat_completions
  api_key: sk-or-…your OpenRouter key…
  default_headers:
    X-Gate-Api-Key: sk-gw-…your Gate key…
    X-Gate-Upstream-Url: https://openrouter.ai/api/v1

Here api_key is your own upstream (OpenRouter) key, which Gate forwards; your Gate key travels in the X-Gate-Api-Key header.

Not every upstream keeps a static key in config.yaml: Nous Portal resolves its credential at runtime through its own auth. For those, leave the provider’s normal auth flow intact and add only Gate’s default_headers — see Use a Nous Portal subscription.

Use a Nous Portal subscription

If your BYOK provider is a Nous Portal subscription, keep Hermes native to Nous rather than switching to a custom endpoint. Leaving provider: nous in place keeps Portal’s auth and its dynamic model discovery — you redirect only the inference API through Gate with NOUS_INFERENCE_BASE_URL.

In ~/.hermes/.env:

Terminal window
NOUS_INFERENCE_BASE_URL=https://gateway.constellationgate.ai/v1

In ~/.hermes/config.yaml:

model:
  provider: nous
  default: stepfun/step-3.7-flash:free
  default_headers:
    X-Gate-Api-Key: sk-gw-…your Gate key…
    X-Gate-Upstream-Url: https://inference-api.nousresearch.com

Keep provider: nous — switching to provider: custom bypasses Portal’s model discovery and auth. Gate’s headers travel in default_headers on the OpenAI wire, the same as the OpenRouter setup above; X-Gate-Upstream-Url points at Portal’s inference API so Gate forwards there under your subscription.

Confirm requests are flowing

If you edited config.yaml directly, restart Hermes so it loads the change. Then open the dashboard and run Hermes the way you normally would. New requests appear on the Messages page within a few seconds, each with its model, cost, and security result.

  • Authentication: keys, and how each request decides who pays.
  • OpenAI SDK: the same OpenAI-compatible endpoint for your own code.
  • Plans: how model usage is billed.