oh ai-gateway
Keeps an AI Gateway token fresh for Claude Code and Codex, so you never paste one. Set the gateway once with oh-configure (AI Gateway URL), or pass --gateway-url https://ai-gateway-<id>.dp.onehouse.ai to any subcommand. The gateway must be reachable from your machine, for example over VPN.
oh ai-gateway login signs you in to the AI Gateway only. To sign in to the Onehouse API, use oh login.
Typical use as a person:
oh ai-gateway login # once; prints the one-time MCP setup
oh ai-gateway run -- claude # every session
oh ai-gateway run -- codex -m <model alias>
As a service principal, use a profile that holds its API key and secret, and skip login.
oh ai-gateway login
Signs you in to the AI Gateway through your browser. The refresh token goes in your OS keychain; access tokens stay in memory. It prints the MCP entry to add for Claude Code and Codex.
| Flag | Required | Description |
|---|---|---|
--gateway-url | No | AI Gateway URL. Default: the profile's ai_gateway_url. |
--port | No | Pin the local callback port, for an SSH port forward. Default: any free port. |
--no-browser | No | Print the sign-in URL instead of opening it. |
oh ai-gateway login
oh ai-gateway run COMMAND...
Runs Claude Code or Codex through a local proxy that keeps the token fresh. The proxy listens on 127.0.0.1 and stops when the client exits. Its port and a per-run secret go straight into the client's environment, so nothing is copied or written to disk.
| Flag | Required | Description |
|---|---|---|
--gateway-url | No | AI Gateway URL. Default: the profile's ai_gateway_url. |
--client | No | claude or codex. Default: taken from the command's name. |
oh ai-gateway run -- claude
oh ai-gateway run -- codex -m gpt-5
Codex sends only /v1/responses, so -m must name a model alias served by an OpenAI model that supports the Responses API. run warns when ANTHROPIC_API_KEY is set, because that key displaces your subscription and is forwarded upstream.
oh ai-gateway token
Prints a current AI Gateway token. It never prompts: if a person's sign-in has expired, it fails with an error that names oh ai-gateway login.
| Flag | Required | Description |
|---|---|---|
--gateway-url | No | AI Gateway URL. Default: the profile's ai_gateway_url. |
--format | No | header (default) or mcp-headers, the JSON an MCP headers helper returns. |
Use it as the MCP headers helper, which the client runs on every connection and again after a 401. Add the entry at user scope:
claude mcp add-json --scope user oh-ai-gateway \
'{"type":"http","url":"<gateway>/mcp","headersHelper":"oh ai-gateway token --format mcp-headers --gateway-url <gateway>"}'
For Codex 0.148.0 or later, in ~/.codex/config.toml:
[mcp_servers.oh-ai-gateway]
url = "<gateway>/mcp"
http_headers_helper = "oh ai-gateway token --format mcp-headers --gateway-url <gateway>"
oh ai-gateway proxy
Runs the local proxy on its own, for a client that oh ai-gateway run does not cover. It prints the two environment variables to set.
| Flag | Required | Description |
|---|---|---|
--gateway-url | No | AI Gateway URL. Default: the profile's ai_gateway_url. |
--port | No | Local port. Default: any free port. |
oh ai-gateway proxy
oh ai-gateway logout
Signs you out of the AI Gateway. The profile's service principal, if any, applies again. Tokens already issued stay valid until they expire, up to 7 days.
| Flag | Required | Description |
|---|---|---|
--gateway-url | No | AI Gateway URL. Default: the profile's ai_gateway_url. |
oh ai-gateway logout