Integration Guides
Connect your application to Keel. Keel evaluates a model call or a Stripe MPP or x402 payment, dispatches it only when allowed, and records route-appropriate evidence. Tool calls go through Keel's managed MCP route for enrolled servers.
Advanced external-enforcement and compatibility patterns remain available for architectures that already have a trusted execution boundary or specialized runtime constraints.
Connect your application
New integrations should begin with Unified Execute. Blocking outcomes stop before Keel dispatch.
Advanced architectures
Review these details when an existing enforcement boundary or compatibility requirement needs a different API request format or caller responsibility.
External Enforcement (Permit-First)
Use only when another trusted enforcement point owns execution and will enforce Keel's decision before acting. Keel decides only actions it can classify; a Permit for any other action is refused.
Best for: Established systems with a trusted, independently controlled execution boundary.
Review External EnforcementCompatibility Surfaces
Use provider-native proxy routes for compatibility or the deeper provider-neutral execution contract when your runtime needs tighter surface control.
Best for: Teams with existing provider-native traffic or deeper runtime requirements.
Read Integration DetailsContract comparison
| Path | Best for | What changes in your system | Speed to adopt |
|---|---|---|---|
| Connect with Execute | Connect an application to Keel | Send requests to Keel's primary public runtime surface | Fast |
| External Enforcement (Permit-First) | A trusted external system already owns execution | That system asks Keel for a decision and must enforce it | Medium |
| Compatibility and Advanced | Provider-native compatibility or deeper control | Use provider-native proxy routes or the provider-neutral contract | Medium to advanced |
Connect with Execute
Best for: Connect an application to Keel
Changes: Send requests to Keel's primary public runtime surface
Speed: Fast
External Enforcement (Permit-First)
Best for: A trusted external system already owns execution
Changes: That system asks Keel for a decision and must enforce it
Speed: Medium
Compatibility and Advanced
Best for: Provider-native compatibility or deeper control
Changes: Use provider-native proxy routes or the provider-neutral contract
Speed: Medium to advanced
Unified Execute
The primary public runtime surface for most customers.
- 1Start with the primary public runtime surface at /v1/execute
- 2Let Keel evaluate authorization rules before dispatch
- 3Connect additional supported actions as your application expands
Advanced: External Enforcement (Permit-First)
Use only when another trusted enforcement point owns execution and will enforce Keel's decision. Keel does not dispatch on this path, so it records the decision but cannot enforce it. A tool on an MCP server you register yourself needs a human-approved action mapping, and its calls always go to review.
- 1Create a permit request before a model call (for example generate.text). Keel decides from the request's provider, model and operation; the action name is recorded but not classified. Message, calendar, call and travel operations are refused on this route (unsupported_operation), and tools go through an enrolled MCP connector instead
- 2Let your application execute only when allowed
- 3Report usage as supplied evidence; it is not independently observed execution
Compatibility and Advanced
Use provider-native proxy routes or the deeper provider-neutral execution contract when your runtime needs them.
- 1Choose between provider-native proxy routes and the provider-neutral execution contract
- 2Use the surface that matches your payload model or migration constraints
- 3Review the decision and available lifecycle evidence in Keel
Works with
Vercel AI SDK
Use ai@6 with @ai-sdk/openai-compatible@2 for Chat Completions model calls through Keel. Keep the Keel key on the server and configure the provider key in Keel. The fetch adapter adds the timestamp and nonce required for each HTTP attempt, then sends the SDK call to Keel's public proxy route. The invocation-level headers preserve one idempotency key across retries of that model request. Save its exact prompt and key for an unchanged retry; create a new key for each new invocation. Do not use one global key across prompts or tool-loop steps. Do not switch to a new key after an unknown outcome; reconcile the original request first.
npm install ai@6 @ai-sdk/openai-compatible@2import { generateText } from "ai";
import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
const keel = createOpenAICompatible({
name: "keel",
baseURL: "https://api.keelapi.com/v1/proxy/openai",
apiKey: process.env.KEEL_API_KEY!,
fetch: (input, init) => {
const proxyEndpoint = "https://api.keelapi.com/v1/proxy/openai";
const endpoint = proxyEndpoint + "/chat/completions";
const target = input instanceof Request ? input.url : String(input);
if (target !== endpoint) throw new TypeError("SDK request is outside the Keel chat endpoint");
const headers = new Headers(input instanceof Request ? input.headers : undefined);
new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
headers.set("X-Keel-Timestamp", String(Math.floor(Date.now() / 1000)));
headers.set("X-Keel-Nonce", "nonce-" + crypto.randomUUID().replaceAll("-", ""));
const outbound = input instanceof Request ? new Request(proxyEndpoint, input) : proxyEndpoint;
return fetch(outbound, { ...init, headers });
},
});
const idempotencyKey = crypto.randomUUID(); // Save with this invocation for an unchanged retry.
const { text } = await generateText({
model: keel.chatModel("gpt-4o-mini"),
prompt: "Hello",
headers: { "Idempotency-Key": idempotencyKey },
});Before the first call, enable the proxy route for your Keel project, allow the chosen model in policy, and test the server-side OpenAI provider key in Keel. If you see request_not_fresh, check the timestamp and nonce adapter; proxy_routes_disabled means the project has the compatibility route off; upstream_error requires checking the provider configuration or response.
This routes model calls through Keel. Requests that include tool definitions are refused before dispatch (platform_safety_floor.unknown_action); to govern tools your application executes, route those actions through Keel separately, such as its managed MCP call path. See theintegration coverage guidefor the exact boundary of each stack item.
Read the public proxy referenceRecommended rollout
Connect additional supported actions to Keel as your application expands. For API formats, dispatch responsibilities, and external enforcement requirements, see the advanced integration documentation.