Docs

Quickstart

curl -X POST https://toolgate.scribase.com/v1/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"org_name": "acme"}'
# -> {"ok":true,"data":{"org":{...},"project":{...},"key":"sk-t0-...","key_id":"...","note":"..."}}

curl https://toolgate.scribase.com/v1/tools/knowledge.wikipedia.summary/call \
  -H "Authorization: Bearer sk-t0-..." \
  -H "Content-Type: application/json" \
  -d '{"input": {"title": "Rust (programming language)"}}'

The key works immediately on every free/public tool. A paid tool answers 402 with a topup_url until the project has a Mint balance.

Auth

Every key is a per-org scoped credential: it belongs to exactly one org's one project, created either by self-serve signup above or by POST /v1/keys once you hold an admin-scoped key for that project. It can only see and spend that org's own usage and balance — never another tenant's.

• GET /v1/keys / POST /v1/keys — list or create a key, optionally narrowed with scopes, a tool_allow list and a per_key_daily_cap_micros cap.
• PATCH /v1/keys/{id} / POST /v1/keys/{id}/revoke — adjust or revoke a key.
• The same key reaches Relay's OpenAI-compatible /openai/v1 as well as Toolgate's own /v1/tools.
• OAuth 2.1 (PKCE, dynamic client registration, device flow) is available at /.well-known/oauth-authorization-server for agent clients that cannot hold a static key.
• Never pass a provider's own API key through a request — store it once with POST /v1/credentials (write-only; values are never returned) and Toolgate injects it server-side.

Tool catalog

24 capabilities, 27 tools as of this build (18 free/public, 9 priced) — generated from the same catalog manifests that back every call:

• /catalog — human-browsable, with a ready curl snippet per tool.
• /catalog.md — the same content as markdown, for agents.
• GET /v1/catalog — the same data as JSON.
• GET /v1/tools/search?q= — search by task; GET /v1/tools/{id} — schema, price and fallback chain, spends nothing.
• /llms.txt / /llms-full.txt — machine-readable index for AI agents.

Billing & metering

Every paid call follows the same three-step lifecycle on Mint:

1. Hold — the quoted price is placed as a hold against the project's Mint balance before the call runs.
2. Capture — on a successful call, the exact quoted amount is captured to the platform's Mint revenue account.
3. Release — on failure, the hold is released and nothing is ever billed.

Usage is also reported to Rago as tool_call events for the org's own metering dashboards. Spend caps — project monthly, project daily, per-key daily and per-tool daily — are enforced synchronously in the request path: each check adds spend-so-far plus every other in-flight (not-yet-settled) call's reservation and rejects with 429 cap_exceeded before a hold is ever placed, so concurrent calls cannot race past a limit.

• GET /v1/balance / POST /v1/balance/topup — current balance, spend vs. caps, start a top-up checkout.
• GET /v1/usage — spend grouped by tool, provider, key or day.
• GET /v1/usage/calls/{id} — one call's full record, including its hash-chained receipt.
• PATCH /v1/project — set monthly_cap_micros, daily_cap_micros, tool_daily_caps and the routing policy.