Proxy setup

Supported routes

Provider protocol	Kastra endpoint
OpenAI Chat Completions	POST https://api.kastra.ai/v1/chat/completions
Anthropic Messages	POST https://api.kastra.ai/v1/messages

These are the provider routes mounted by the current application. OpenAI Responses, Azure-specific endpoints, and other providers must not be inferred from generic compatibility or a logo.

Prerequisites

Create an environment API key in Kastra and obtain your upstream provider key. Confirm your workspace’s proxy entitlement; the catalog distinguishes Team proxy access from the Pro trial. Keep both credentials on a trusted server.

The request needs:

• Authorization: Bearer <KASTRA_API_KEY> for Kastra.
• X-Upstream-API-Key: <PROVIDER_API_KEY> for the selected provider.
• The provider’s supported JSON body and a model you can access.
• An appropriate X-Jurisdiction value when the policy uses jurisdiction.

A base-URL change alone does not supply the upstream key or implement approval handling. Use the OpenAI or Anthropic example.

Handle the result before executing tools

Inspect HTTP status, the provider-shaped error body, and policy headers. Supported output controls can remove, block, or hold generated tool calls before your application executes them. Your application must honor the result.

For interactive approval flows, choose async proxy HOLD or a supported waiting path. Streaming has additional error and partial-output semantics.

Verify

Test allow, pre-request deny, output deny, and the chosen approval flow in a test environment. Confirm both policy records and whether an upstream request or downstream tool execution actually happened. Calls sent directly to a provider remain outside this proxy.