Integration Guides

    Connect your application to Keel. Keel evaluates a model call or a Stripe MPP or x402 payment, dispatches it only when allowed, and records route-appropriate evidence. Tool calls go through Keel's managed MCP route for enrolled servers.

    Advanced external-enforcement and compatibility patterns remain available for architectures that already have a trusted execution boundary or specialized runtime constraints.

    Contract comparison

    Connect with Execute

    Best for: Connect an application to Keel

    Changes: Send requests to Keel's primary public runtime surface

    Speed: Fast

    External Enforcement (Permit-First)

    Best for: A trusted external system already owns execution

    Changes: That system asks Keel for a decision and must enforce it

    Speed: Medium

    Compatibility and Advanced

    Best for: Provider-native compatibility or deeper control

    Changes: Use provider-native proxy routes or the provider-neutral contract

    Speed: Medium to advanced

    Unified Execute

    The primary public runtime surface for most customers.

    1. 1Start with the primary public runtime surface at /v1/execute
    2. 2Let Keel evaluate authorization rules before dispatch
    3. 3Connect additional supported actions as your application expands

    Advanced: External Enforcement (Permit-First)

    Use only when another trusted enforcement point owns execution and will enforce Keel's decision. Keel does not dispatch on this path, so it records the decision but cannot enforce it. A tool on an MCP server you register yourself needs a human-approved action mapping, and its calls always go to review.

    1. 1Create a permit request before a model call (for example generate.text). Keel decides from the request's provider, model and operation; the action name is recorded but not classified. Message, calendar, call and travel operations are refused on this route (unsupported_operation), and tools go through an enrolled MCP connector instead
    2. 2Let your application execute only when allowed
    3. 3Report usage as supplied evidence; it is not independently observed execution

    Compatibility and Advanced

    Use provider-native proxy routes or the deeper provider-neutral execution contract when your runtime needs them.

    1. 1Choose between provider-native proxy routes and the provider-neutral execution contract
    2. 2Use the surface that matches your payload model or migration constraints
    3. 3Review the decision and available lifecycle evidence in Keel

    Works with

    Vercel AI SDK

    Use ai@6 with @ai-sdk/openai-compatible@2 for Chat Completions model calls through Keel. Keep the Keel key on the server and configure the provider key in Keel. The fetch adapter adds the timestamp and nonce required for each HTTP attempt, then sends the SDK call to Keel's public proxy route. The invocation-level headers preserve one idempotency key across retries of that model request. Save its exact prompt and key for an unchanged retry; create a new key for each new invocation. Do not use one global key across prompts or tool-loop steps. Do not switch to a new key after an unknown outcome; reconcile the original request first.

    npm install ai@6 @ai-sdk/openai-compatible@2
    import { generateText } from "ai";
    import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
    
    const keel = createOpenAICompatible({
      name: "keel",
      baseURL: "https://api.keelapi.com/v1/proxy/openai",
      apiKey: process.env.KEEL_API_KEY!,
      fetch: (input, init) => {
        const proxyEndpoint = "https://api.keelapi.com/v1/proxy/openai";
        const endpoint = proxyEndpoint + "/chat/completions";
        const target = input instanceof Request ? input.url : String(input);
        if (target !== endpoint) throw new TypeError("SDK request is outside the Keel chat endpoint");
        const headers = new Headers(input instanceof Request ? input.headers : undefined);
        new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
        headers.set("X-Keel-Timestamp", String(Math.floor(Date.now() / 1000)));
        headers.set("X-Keel-Nonce", "nonce-" + crypto.randomUUID().replaceAll("-", ""));
        const outbound = input instanceof Request ? new Request(proxyEndpoint, input) : proxyEndpoint;
        return fetch(outbound, { ...init, headers });
      },
    });
    
    const idempotencyKey = crypto.randomUUID(); // Save with this invocation for an unchanged retry.
    const { text } = await generateText({
      model: keel.chatModel("gpt-4o-mini"),
      prompt: "Hello",
      headers: { "Idempotency-Key": idempotencyKey },
    });

    Before the first call, enable the proxy route for your Keel project, allow the chosen model in policy, and test the server-side OpenAI provider key in Keel. If you see request_not_fresh, check the timestamp and nonce adapter; proxy_routes_disabled means the project has the compatibility route off; upstream_error requires checking the provider configuration or response.

    This routes model calls through Keel. Requests that include tool definitions are refused before dispatch (platform_safety_floor.unknown_action); to govern tools your application executes, route those actions through Keel separately, such as its managed MCP call path. See theintegration coverage guidefor the exact boundary of each stack item.

    Read the public proxy reference

    Recommended rollout

    Connect additional supported actions to Keel as your application expands. For API formats, dispatch responsibilities, and external enforcement requirements, see the advanced integration documentation.

    1
    Connect your application to Keel
    2
    Connect supported actions
    3
    Review advanced integration details when needed

    Connect your application to Keel

    Connect your application to Keel to evaluate supported actions against authorization rules before dispatch and record their decisions and evidence.