Connect a Gateway

A gateway lets your agents use your own Claude Code or Codex (ChatGPT) account — by subscription or API key — instead of Qlar credits.

You run a small program on a computer or server you control, next to Claude Code and/or Codex. It opens one outbound connection to Qlar's gateway service, receives requests from your agents, runs them through those tools, and sends the answers back. Nothing connects in, so no firewall changes are needed.

Who can do this? Owners and Admins, in an organization where Qlar has turned gateways on. If you don't see Connect a gateway, ask Qlar support to turn gateways on for your organization.

Qlar models, API keys and gateways

An organization can get its models from three places. All three appear side by side under Organization → AI Models, and your agents pick from them the same way.

Choose a gateway when you already pay for a Claude or ChatGPT plan and want your agents to use it, or when an API key must never leave your own machine. Choose an API key when the model has to be available around the clock without a computer of yours being on.

What a gateway protects, and what it does not

It does protect:

• Your network. The gateway only connects outward over HTTPS. No inbound port, no listening socket.
• Your keys and sign-ins. API keys you give the gateway are stored encrypted on that computer, and the Claude Code and Codex sign-ins stay where they are. None of them is ever sent to Qlar.
• Your computer. Claude Code and Codex run in an empty temporary folder with their own tools switched off: no shell, no files, no web, no MCP servers or plugins. A request that tries to use one is stopped. (Codex's image generation is the only exception, for image requests.)
• Who may connect. The one-time code is useless on its own. A gateway serves nothing until a person approves its key fingerprint in Qlar, and Qlar never stores the code.

It does not protect:

• The conversation itself. What users ask, and the answers, still pass through Qlar and reach Anthropic or OpenAI through your account. That account's own terms and data settings apply.
• Availability. The computer must stay on and the gateway running. While it is off, the agents using its models can't answer, and voice calls on it end.
• Your plan's limits. Your subscription's usage limits, fair-use rules and terms apply to everything your agents send through it. When the plan hits its limit, replies fail until it resets.
• Capacity. A gateway runs 2 requests at a time by default (the gateway's card shows its own limit). More at once are turned away as busy, so a gateway suits an internal team or a pilot better than a busy public website.
• Anyone who can use that computer as the user that runs the gateway can also use its signed-in tools.

Before you start

• A computer or server that can stay on:
  • Windows 10 or 11, x64 (Windows on Arm runs it under emulation). Uses PowerShell; no admin rights needed to install.
  • macOS on Apple silicon (M1 or later). Intel Macs are not supported.
  • Linux x64 or arm64 with glibc (Debian, Ubuntu, Fedora, …). Alpine and other musl-based systems are not supported.
• Claude Code and/or Codex installed on that computer. You sign them in during step 4 — with your subscription (your Claude or ChatGPT plan) or an API key.
• Outbound HTTPS (port 443) from that computer. For voice on a ChatGPT subscription, also outbound UDP port 3478 (see Voice on your gateway).
• Owner or Admin role in the organization.

Setting it up

Open the Organization page → Configure on your organization → AI Models tile → Sources tab.

1. Name it and pick its system

Click Connect a gateway. Give the gateway a Name your team will recognise in model lists, for example "Office PC" (you can rename it later), and choose the system of the computer it will run on: Windows, macOS or Linux. Then click Create code.

2. Run the command on that computer

Qlar shows one command, built for the system you chose, with your one-time code already in it. Click Copy command, then on that computer:

The command looks like this — always copy it from the page, because Qlar fills in the gateway service's address and your code:

# Windows
& ([scriptblock]::Create((irm 'https://<gateway service>/install.ps1'))) -Code 'XXXX-XXXX-XXXX' -Force

# macOS and Linux
curl -fsSL 'https://<gateway service>/install.sh' | sh -s -- --code 'XXXX-XXXX-XXXX' --force

It downloads the gateway, checks its checksum, installs it for your user (no admin rights), and connects it with your code. Leave the window open: the gateway keeps running in it.

Good to know:

• The code is single use and expires after 15 minutes. Qlar doesn't keep it, so it can't be shown again. If it expires or you lose it, click Get a new code.
• Setting up from your phone? Tap Send to my computer… to send the command to yourself (by message or email) and open it on the computer. Where sharing isn't available, the button copies the command instead.
• Running it on a computer that already has a gateway replaces that gateway. The command always re-enrols the computer.
• Gateway already installed? The page also shows a shorter command, qlar-inference-gateway enroll --hub … --code … --force.
• You can leave the page. Setup continues from the gateway's card under Sources. Cancel deletes a gateway that hasn't been approved yet.

3. Compare the fingerprint and approve

When the command has run, the gateway prints a key fingerprint in the terminal: 16 groups of 4 characters, in 4 rows. Qlar shows the computer's name, its system and the same fingerprint, laid out the same way.

Compare every group, and approve only if they are identical. Click Fingerprint matches — approve.

This is the step that matters. Until you approve, the gateway receives nothing. If the fingerprint is different from your terminal, someone else used your code: click It doesn't match — cancel and start again.

4. Sign in each tool and choose models

Back in the terminal, the gateway asks, for each tool it found, how it signs in:

• Subscription uses the tool's own sign-in: your Claude plan for Claude Code, your ChatGPT plan for Codex.
• API key asks for a key (typed hidden). It is stored encrypted on that computer and never reaches Qlar.

Qlar shows each tool's state — for example Claude Code · subscription (Max) or Codex (ChatGPT) · not signed in — and the models the computer offers. Tick the ones your agents may use and give each a name: that is what your team sees in model lists. Names use lower-case letters, digits, ., _ or -, and can't contain + (that marks Fast mode). Click Finish.

A tool that isn't signed in shows what to run on that computer — claude (then sign in) for Claude Code, codex login for Codex — as the same user that runs the gateway. After signing in, restart the gateway or wait up to 5 minutes for it to notice. You can come back to add models later with Models on the gateway's card.

Only models that can chat, call tools and return structured answers are offered; Claude Code and Codex both can.

5. Keep it running

The gateway runs in the window you started it from, so it stops when that window closes or the computer restarts. Once setup is done, stop it (Ctrl+C) and install it as a service, once:

The service runs as your user, so it uses the same Claude Code and Codex sign-ins. That's it: the card shows Connected · ● Online.

Using gateway models

Gateway models appear under Models in their own group, Your gateways, with where they run: ● Office PC while online, ○ Office PC, offline 3 h ago while not.

From then on you use them like any other model:

• In an agent: as the conversation model, in Allowed Conversation AI Models, and as the Answering AI model of a Natural conversation voice call. Model lists group them under the gateway's name.
• As a feature default under Defaults, for every feature except KB Training.

What to expect:

• No Qlar credits are charged for a gateway model's tokens. Tools the answer uses — web search, knowledge base, plugins — are billed as usual.
• Not for content training or image description. Knowledge base training and describing uploaded images keep using Qlar or API-key models; gateway models aren't offered there.
• Replies fail while the computer is offline. Users see "This assistant can't answer right now. Please try again later." — never the computer's name. When all its request slots are in use they see "This assistant is busy right now. Please try again in a moment." The details, with the gateway's name and the reason, go to the agent's Monitoring Logs. The AI Models page also shows a banner while a gateway with models in use is offline.
• If Qlar turns gateways off for your organization, their models stop being used and features fall back to the Qlar default. Nothing is deleted: everything comes back as it was when gateways are turned on again. You can still remove a gateway meanwhile.

Voice on your gateway

A gateway with Codex can also run the voice of a Natural conversation call, using the realtime voice of the account signed in on that computer. Claude Code has no voice.

On the agent's Conversation → Voice page, choose Natural conversation, then under Voice runs on pick the gateway instead of Qlar. Gateways that can't take calls are shown greyed out with the reason (offline, not connected yet, its tools can't do voice, or Codex isn't signed in).

Voice on a gateway isn't available while Privacy Mode is on; calls of an agent set to a gateway end until it is off. If a gateway that runs an agent's voice is removed, that agent's calls stop until you choose where voice runs again. The Talk by Voice guide has more.

Running it

Each gateway's card under Sources shows its state, the computer, its system and version, how many requests are running, and how each tool is signed in. The ⋯ menu holds the rest.

Removing a gateway disconnects it for good — it stops on its computer and can't be used again — and:

• its models are removed from the organization, and agents using them fall back to the organization default;
• feature defaults that used them go back to the Qlar default, which uses Qlar credits;
• agents whose voice runs on it stop taking voice calls until another voice is chosen. They don't move to Qlar's voice.

A gateway that was never approved is removed straight away. To remove the program from the computer as well, run qlar-inference-gateway uninstall-service (elevated on Windows), "$HOME/.local/bin/qlar-inference-gateway" uninstall-service on macOS, or sudo "$HOME/.local/bin/qlar-inference-gateway" uninstall-service on Linux, then delete it.

Troubleshooting

Related Pages

• Bring Your Own Key
• AI Models (organization)
• AI Models screen reference
• Natural Conversation Settings
• Model & Context