Docs

Get started

Govern your agents' token spend — across every provider, user, and system. Here's the fastest path from zero to a metered, capped, audited agent.

1

Create your account

Sign up free and get two keys, shown once: an agent key (pxy_) for your agents, and a management key (sk_) for provisioning and policy. No card required.

Create a wallet →
2

Route model calls through the gateway

Point your model SDK's base URL at Sanction and add the x-sanction-key header. You keep your own provider key — Sanction meters every token and enforces the budget, across providers, on one key.

import OpenAI from "openai"

const client = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY,                       // your key — Sanction forwards it
  baseURL: "https://getsanction.com/api/gateway/openai/v1", // route through Sanction
  defaultHeaders: { "x-sanction-key": "pxy_your_agent_key" },
})
// call client as normal — every token is metered and capped, then forwarded to OpenAI
3

Authorize actions before money moves

Before an agent spends, it asks. Sanction returns approve, escalate, or deny in real time. Small charges clear, risky ones escalate to a human, blocked ones never run, and every decision is logged.

curl -X POST https://getsanction.com/api/v1/authorize \
  -H "x-api-key: pxy_your_agent_key" \
  -H "content-type: application/json" \
  -d '{"action":"purchase","amount_usd":5,"merchant":"OpenAI","category":"software"}'

# → { "authorized": true, "status": "approved", "request_id": "req_…" }
# Raise amount_usd to 40 and it comes back "escalated" — a human approves before it spends.

Common workflows

Patterns teams reach for first.

Internal AI governance

Departments as wallets — govern your own org's AI spend

Engineering, marketing, and ops each get a wallet with the budget their cost center owns. Seats inside for the people and agents doing the work; a pooled daily cap enforces the department line at the gateway, roll-ups give finance chargeback by team, and when something runs away, freeze is one call. Hard enforcement, not a dashboard you check after the invoice.

Agent fleets guide →

Overnight agents

Cap the agent that runs all night

An autonomous coding or research agent works your backlog overnight, burning tokens while you sleep. Set a daily token budget on the agent — the gateway returns 402 and stops the call the moment the cap is hit, before the overrun.

Gateway reference →

Multi-tenant platforms

Govern many agents under one account

Running agents for many customers? Provision one agent per tenant under a master account, set per-tenant budgets, and roll spend up for chargeback. One place to govern the whole fleet.

# Create an agent per tenant (management key — server-side only)
curl -X POST https://getsanction.com/api/v1/agents \
  -H "x-mgmt-key: sk_your_management_key" \
  -H "content-type: application/json" \
  -d '{"wallet_id":"wlt_…","name":"tenant_42"}'
# → returns a pxy_ key (shown once) for that tenant's agent
Multi-tenant runbook →

Cross-provider cost control

See and cap spend across every provider

Token pricing is the digital Wild West — rates change mid-cycle, and the question becomes which provider to use. Route Anthropic, OpenAI, and Gemini through one gateway and one key; every call is metered and capped in one place.

Vercel AI SDK guide →

Concepts

The model behind the endpoints — read these once and every API makes sense.

How Sanction works

The architecture in one diagram: identity upstream, one atomic decision, evidence.

Why Sanction

Six claims on why authorization is its own system.

Authorization: the decision

Wallets, agents, the ladder, grants — and the invariants.

Evidence & replay

Revisions, stored contexts, replay with proof, what-if simulation.

Capability governance

New powers ask first — skills and plugins governed like money.

Security & threat model

Trust boundaries, fail-closed invariants, vault encryption, tenant isolation, disclosure.

EU AI Act

Evidence + oversight for the agents you run: Art 12/13/14 mapped to signed audit, transparency, and human approvals.

Ecosystem distribution

Where Sanction fits into the tools agents already use.

Compatibility

Badges, channel packs, and install paths for MCP, frameworks, gateways, and payment-agent pilots.

Compatibility & badges

When each ecosystem claim is true, and which Sanction surface proves it.

Framework adapters

SanctionMiddleware, Python wrappers, and LiteLLM callback recipes.

Licensing

Free for your own agents. Commercial license when your product embeds or resells governance.

Commercial License

FSL vs commercial use, typical buyers, Sanction Local, and what enterprise agreements cover.

FSL source license

Functional Source License 1.1 — full text in the repo (converts to MIT after two years).

Go deeper

Quickstart

First metered, governed call in under five minutes.

The LLM gateway

Meter and cap every token across providers on one key — 402 when over budget.

Vercel AI SDK guide

Drop Sanction into the AI SDK with two lines of config.

LangChain guide

Meter and cap LangChain calls; authorize before spend.

CrewAI guide

Give the crew an authorize tool it must clear to spend.

AWS Bedrock Agents guide

Action Group setup: schema subset, forwarder Lambda, first governed decision.

Agent fleets guide

Channels as pools, seats as keys, envelopes with escalation — and native cost-per-outcome ceilings.

Pay-per-crawl guide

The web charges your agents now — govern every 402 quote with budgets, escalation, and audit.

Multi-tenant Integration Runbook

Provision per tenant, govern budgets, rotate keys.

Full API reference

OpenAPI 3.0 spec — every endpoint, Bedrock-compatible.

Ready to govern your agents?

Free to start. No card required. Two keys and you're live.

Start free →