Docs

Get started

Govern your agents' token spend — across every provider, user, and system. Here's the fastest path from zero to a metered, capped, audited agent.

1

Create your account

Sign up free and get two keys, shown once: an agent key (pxy_) for your agents, and a management key (sk_) for provisioning and policy. No card required.

Create a wallet →
2

Route model calls through the gateway

Point your model SDK's base URL at Sanction and add the x-sanction-key header. You keep your own provider key — Sanction meters every token and enforces the budget, across providers, on one key.

import OpenAI from "openai"

const client = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY,                       // your key — Sanction forwards it
  baseURL: "https://getsanction.com/api/gateway/openai/v1", // route through Sanction
  defaultHeaders: { "x-sanction-key": "pxy_your_agent_key" },
})
// call client as normal — every token is metered and capped, then forwarded to OpenAI
3

Authorize actions before money moves

Before an agent spends, it asks. Sanction returns approve, escalate, or deny in real time. Small charges clear, risky ones escalate to a human, blocked ones never run, and every decision is logged.

curl -X POST https://getsanction.com/api/v1/authorize \
  -H "x-api-key: pxy_your_agent_key" \
  -H "content-type: application/json" \
  -d '{"action":"purchase","amount_usd":5,"merchant":"OpenAI","category":"software"}'

# → { "authorized": true, "status": "approved", "request_id": "req_…" }
# Raise amount_usd to 40 and it comes back "escalated" — a human approves before it spends.

Common workflows

Patterns teams reach for first.

Overnight agents

Cap the agent that runs all night

An autonomous coding or research agent works your backlog overnight, burning tokens while you sleep. Set a daily token budget on the agent — the gateway returns 402 and stops the call the moment the cap is hit, before the overrun.

Gateway reference →

Multi-tenant platforms

Govern many agents under one account

Running agents for many customers? Provision one agent per tenant under a master account, set per-tenant budgets, and roll spend up for chargeback. One place to govern the whole fleet.

# Create an agent per tenant (management key — server-side only)
curl -X POST https://getsanction.com/api/v1/agents \
  -H "x-mgmt-key: sk_your_management_key" \
  -H "content-type: application/json" \
  -d '{"wallet_id":"wlt_…","name":"tenant_42"}'
# → returns a pxy_ key (shown once) for that tenant's agent
Multi-tenant runbook →

Cross-provider cost control

See and cap spend across every provider

Token pricing is the digital Wild West — rates change mid-cycle, and the question becomes which provider to use. Route Anthropic, OpenAI, and Gemini through one gateway and one key; every call is metered and capped in one place.

Vercel AI SDK guide →

Concepts

The model behind the endpoints — read these once and every API makes sense.

How Sanction works

The architecture in one diagram: identity upstream, one atomic decision, evidence.

Why Sanction

Six claims on why authorization is its own system.

Authorization: the decision

Wallets, agents, the ladder, grants — and the invariants.

Evidence & replay

Revisions, stored contexts, replay with proof, what-if simulation.

Capability governance

New powers ask first — skills and plugins governed like money.

Ecosystem distribution

Where Sanction fits into the tools agents already use.

Compatibility

Badges, channel packs, and install paths for MCP, frameworks, gateways, and payment-agent pilots.

Compatibility & badges

When each ecosystem claim is true, and which Sanction surface proves it.

Framework adapters

SanctionMiddleware, Python wrappers, and LiteLLM callback recipes.

Licensing

Free for your own agents. Commercial license when your product embeds or resells governance.

Commercial License

FSL vs commercial use, typical buyers, Sanction Local, and what enterprise agreements cover.

FSL source license

Functional Source License 1.1 — full text in the repo (converts to MIT after two years).

Go deeper

Quickstart

First metered, governed call in under five minutes.

Vercel AI SDK guide

Drop Sanction into the AI SDK with two lines of config.

LangChain guide

Meter and cap LangChain calls; authorize before spend.

CrewAI guide

Give the crew an authorize tool it must clear to spend.

AWS Bedrock Agents guide

Action Group setup: schema subset, forwarder Lambda, first governed decision.

Agent fleets guide

Channels as pools, seats as keys, envelopes with escalation — and native cost-per-outcome ceilings.

Multi-tenant Integration Runbook

Provision per tenant, govern budgets, rotate keys.

Full API reference

OpenAPI 3.0 spec — every endpoint, Bedrock-compatible.

Ready to govern your agents?

Free to start. No card required. Two keys and you're live.

Start free →