From d5ccd144cbdb4962b8a1064268e2b3922a7a33c4 Mon Sep 17 00:00:00 2001 From: Anuj Tyagi Date: Sun, 26 Jul 2026 10:59:33 -0400 Subject: [PATCH 1/3] docs: update --- docs/gateway.md | 12 +++++------- docs/getting-started.md | 15 +++++++-------- 2 files changed, 12 insertions(+), 15 deletions(-) diff --git a/docs/gateway.md b/docs/gateway.md index d218050..d1e3a6b 100644 --- a/docs/gateway.md +++ b/docs/gateway.md @@ -15,14 +15,12 @@ Application or IDE The example below uses two different keys: - `OPENAI_API_KEY` is the upstream provider key used by SentinelGuard to call OpenAI. -- `SENTINELGUARD_GATEWAY_API_KEY` is a client-facing token that you generate. Your - apps, IDEs, and SDKs use this token when calling SentinelGuard at - `http://localhost:8080/v1`. +- `SENTINELGUARD_GATEWAY_API_KEY` is the gateway client token created by the + team running SentinelGuard. Apps, IDEs, and SDKs use this token when calling + SentinelGuard at `http://localhost:8080/v1`. -You do not get `SENTINELGUARD_GATEWAY_API_KEY` from OpenAI, Anthropic, Google, -or a SentinelGuard cloud account. It is a random local secret for your own -SentinelGuard gateway. Generate it once, then use the same value in both -places: +This token is separate from upstream provider API keys. Generate it once for +your gateway, then use the same value in both places: - The SentinelGuard gateway environment, as `SENTINELGUARD_GATEWAY_API_KEY`. - Your app, SDK, or IDE API-key field when its base URL points to diff --git a/docs/getting-started.md b/docs/getting-started.md index ae6a15a..c80b99b 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -67,9 +67,9 @@ Gateway mode usually has two kinds of keys: - An upstream provider key, such as `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, or `MOONSHOT_API_KEY`. SentinelGuard uses this to call the model provider. -- `SENTINELGUARD_GATEWAY_API_KEY`, a client-facing token that you generate. - Applications and IDEs use this token when they call SentinelGuard at - `http://localhost:8080/v1`. +- `SENTINELGUARD_GATEWAY_API_KEY`, the gateway client token created by the + team running SentinelGuard. Applications and IDEs use this token when they + call SentinelGuard at `http://localhost:8080/v1`. For local testing, generate the gateway token locally: @@ -83,11 +83,10 @@ Or set it in your shell directly: export SENTINELGUARD_GATEWAY_API_KEY="$(sentinelguard token)" ``` -You do not get this value from an LLM provider or a SentinelGuard cloud -account. It is a random local secret for your own gateway. -Generate it once, then use the same `sgw_...` value in the SentinelGuard -gateway environment and in your app or IDE API-key field. If you run -`sentinelguard token` again, it creates a different token. +This token is separate from upstream provider API keys. Generate it once, then +use the same `sgw_...` value in the SentinelGuard gateway environment and in +your app or IDE API-key field. If you run `sentinelguard token` again, it +creates a different token. Package-mode library usage does not need `SENTINELGUARD_GATEWAY_API_KEY`. Gateway mode uses it to protect the local or shared proxy endpoint, so clients From cd107bbca49e1751f6b3b01186dfe23f55b39e4b Mon Sep 17 00:00:00 2001 From: Anuj Tyagi Date: Sun, 26 Jul 2026 10:59:46 -0400 Subject: [PATCH 2/3] docs: update --- QUICKSTART.md | 7 +++---- README.md | 9 ++++----- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/QUICKSTART.md b/QUICKSTART.md index d0b5970..02c4b30 100644 --- a/QUICKSTART.md +++ b/QUICKSTART.md @@ -141,10 +141,9 @@ sentinelguard gateway --provider kimi --port 8080 `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, and `MOONSHOT_API_KEY` are upstream provider keys. `SENTINELGUARD_GATEWAY_API_KEY` -is a client-facing token you generate for apps and IDEs that call the -SentinelGuard gateway. You do not get it from an LLM provider; generate it -locally with `sentinelguard token`, then use the same `sgw_...` value in your -app or IDE API-key field. +is the gateway client token created by the team running SentinelGuard. Generate +it locally with `sentinelguard token`, then use the same `sgw_...` value in +your app or IDE API-key field. Package-mode library usage does not need this gateway token. Point OpenAI-compatible apps or IDEs to: diff --git a/README.md b/README.md index 8a47182..f25178f 100644 --- a/README.md +++ b/README.md @@ -205,11 +205,10 @@ sentinelguard gateway \ ``` `OPENAI_API_KEY` is the upstream provider key. `SENTINELGUARD_GATEWAY_API_KEY` -is a client-facing token generated by you for apps, SDKs, and IDEs that call -SentinelGuard at `http://localhost:8080/v1`. -You do not get this value from OpenAI, Anthropic, Google, or a SentinelGuard -cloud account. It is a random local secret for your own gateway; generate it -with `sentinelguard token` or `sentinelguard token --env`. +is the gateway client token created by the team running SentinelGuard. Apps, +SDKs, and IDEs use it when calling SentinelGuard at `http://localhost:8080/v1`. +This token is separate from upstream provider API keys; generate it with +`sentinelguard token` or `sentinelguard token --env`. Generate it once, then use the same `sgw_...` value in the gateway environment and in your app or IDE API-key field. If you run `sentinelguard token` again, it creates a different token. From 03a6a91c51c4f16d8dab41169ce572c471cdff81 Mon Sep 17 00:00:00 2001 From: Anuj Tyagi Date: Sun, 26 Jul 2026 11:00:04 -0400 Subject: [PATCH 3/3] docs: update --- sentinelguard/cli/bootstrap.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sentinelguard/cli/bootstrap.py b/sentinelguard/cli/bootstrap.py index 798b395..43b17b6 100644 --- a/sentinelguard/cli/bootstrap.py +++ b/sentinelguard/cli/bootstrap.py @@ -398,9 +398,9 @@ def _readme(profile: str) -> str: ``` `OPENAI_API_KEY` is the upstream provider key. The - `SENTINELGUARD_GATEWAY_API_KEY` value is a client-facing token that you - generate for apps and IDEs calling SentinelGuard. Use the same `sgw_...` - value in the gateway environment and in each app or IDE API-key field. + `SENTINELGUARD_GATEWAY_API_KEY` value is the gateway client token + created by the team running SentinelGuard. Use the same `sgw_...` value + in the gateway environment and in each app or IDE API-key field. Keep the real upstream provider key only on the SentinelGuard gateway. ## Run With Docker Compose