Your first protected request through the AI Gateway

A guided first run of the WASViking AI Guardian AI Gateway. Turn it on, add your provider key, create a gateway, a route and a key, send one request from a terminal and read it in the request log, with the result to expect at every step.

This guide takes you from an empty WASViking^® AI Gateway to a request that goes through it and shows up in the request log. It uses OpenAI and the gpt-4o-mini model as the example; the steps are the same for Anthropic, Google Gemini and the other providers the gateway supports. Plan for about fifteen minutes.

Every step says what you should see. If a result is different, the troubleshooting table of the full AI Gateway guide explains each error.

Before you start

• The AI Gateway is part of your WASViking contract, or your organization has it as a trial. If its screen shows a locked page with Activate, ask your partner or WASViking sales to include it.
• You have an administrator role, or a role with AI Gateway manage access.
• You have an API key from your model provider with some credit on the account. For OpenAI, open the OpenAI platform, go to API keys, select Create new secret key and copy the key that starts with sk-. A request to gpt-4o-mini costs a small fraction of a cent.
• You have a terminal with curl (macOS and Linux have it; on Windows use PowerShell or the Windows Terminal).

Step 1: open the AI Gateway and turn it on

In the portal menu, open AI Guard, Protection, AI Gateway. A box called Set up your first AI Gateway lists the same steps as this guide.

Select Turn on the AI Gateway at the top right.

What you should see: the page reloads, the notice that the AI Gateway is turned off disappears and the button now reads Turn off.

Step 2: add your provider key

Open the Providers & Models tab and select Add credential.

Select Save credential. On the new row, select Test.

What you should see: a green message, "The provider accepted the key.", with the models your key can reach. If the message is red, the key was refused or the provider could not be reached; the message says which.

Step 3: create a gateway

A gateway is one workload, with its own keys, models, guardrails, limits and budget. Open the Workloads tab and select New gateway.

Select Save gateway.

What you should see: the gateway appears in the list as active.

Step 4: route the gateway to your provider

Open the Routing & Failover tab.

Select Add route.

What you should see: the route listed under the gateway as primary and enabled.

Step 5: create a key for your application

Open the Access & Keys tab.

Select Create key. The key starts with wvag_. Select Copy and keep it somewhere safe: it is shown only this once.

Step 6: send your first request

The Integrations tab shows the base URLs for your organization and ready examples for the OpenAI SDK, the Anthropic SDK and Gemini REST. This guide uses curl.

In the terminal, store the gateway key in a variable (replace paste-your-wvag-key-here with your key):

export WASVIKING_GATEWAY_KEY='paste-your-wvag-key-here'

Then send the request:

curl -s https://api.wasviking.com/ai-gateway/openai/v1/chat/completions \
  -H "Authorization: Bearer $WASVIKING_GATEWAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o-mini", "messages": [{"role": "user", "content": "In one sentence, what is an AI gateway?"}]}'

What you should see: a JSON reply in the provider's usual format. The answer is in choices[0].message.content. Add -i after curl to also see the response headers: x-wasviking-routed-model names the model that answered.

Step 7: read the request in the log

Back in the portal, open the Traffic tab.

What you should see: one line for your request with:

Select the line to open the request detail: the data classes found, the policy and detector versions, the tokens and the trace id. The gateway never stores the prompt or the answer, only how they were classified.

Step 8: two quick checks

These show the gateway deciding before anything reaches the provider.

1. A model the gateway does not allow. Send the request from step 6 again with "model": "gpt-4o". The reply is 403 with the code model_not_allowed, and the Traffic tab shows the attempt with the decision Model not allowed.
2. A key that is not valid. Send the request with -H "Authorization: Bearer wvag_not_a_real_key". The reply is 401 with the code invalid_api_key. This attempt does not appear in Traffic: the key is refused before the gateway knows which organization it belongs to.

What to do next

• Create the rules that protect your data: block secrets in prompts, replace personal data before it leaves, stop prompt injection and hold answers that carry secrets. Step 7 of the AI Gateway guide lists them, and the Policy simulator shows what a rule would do before you apply it.
• Point your real application at the gateway: change its base URL and its key, and keep the SDK it already uses.
• Protect the tools your agents call with the MCP Gateway.