---
title: "Connect apiToken.sale — execution guide for AI agents"
description: "Detect the current client, configure its native protocol securely, and verify within an explicit budget."
url: "https://apitoken.sale/docs#agent-setup"
language: "en"
---
# Connect apiToken.sale

This is the canonical agent setup contract. Connect the user's existing client with the smallest
necessary change. Read only the matching client and operating-system guide. This task does not
authorize unrelated installs, repository changes, or production deployment.

## Inspect and select

1. Identify the OS, shell, installed client/SDK and version, existing provider configuration,
   and the runtime that actually sends requests. For WSL, containers, or remote IDEs, inspect that
   runtime rather than only the desktop OS.
2. Preserve the existing native protocol and model family when possible. Read the matching client
   guide at https://apitoken.sale/md/int and its installed configuration. If custom providers/base URLs
   are unsupported, report that constraint and a supported option.
3. Discover available models with the customer key. Use exact returned IDs and their capabilities;
   do not infer limits from a family name or copy a stale model list. Reference: https://apitoken.sale/md/models.

| Protocol | Base URL | Auth header | Discovery |
|---|---|---|---|
| Anthropic Messages | https://router.apitoken.sale | x-api-key; anthropic-version: 2023-06-01 | GET https://router.apitoken.sale/v1/models |
| OpenAI Responses / Chat Completions | https://router.apitoken.sale/v1 | Authorization: Bearer | GET https://router.apitoken.sale/v1/models |
| Native Gemini | https://router.apitoken.sale | x-goog-api-key | GET https://router.apitoken.sale/v1beta/models |

Messages uses POST https://router.apitoken.sale/v1/messages. OpenAI uses /responses or /chat/completions under
its /v1 base; avoid /v1/v1. Gemini uses /v1beta/models/{exact-id}:generateContent or
:streamGenerateContent. All use the same customer key and engine account balance. For exact request
fields, adapters, streaming controls, and limitations, read https://apitoken.sale/md/docs only for the
selected protocol. The subscription request adapter rewrites provider identity; it preserves
ordered client instructions and response streaming. Do not promise unchanged outbound request bytes.

## Configure securely

Never print, log, commit, or paste a full customer key into chat, screenshots, source files, browser
code, or public build variables such as NEXT_PUBLIC_* and VITE_*. Use the client's protected secret
store or a server-side environment variable. An ignored .env.local is acceptable; .env.example
contains variable names only. If the key is missing, the user enters it locally after creating it at
https://apitoken.sale/dashboard?view=keys. Do not request the full key in a message.

For Claude Code, Codex, Gemini CLI, Kimi Code, OpenCode, Pi, and Hermes, use the maintained
one-command setup for the detected OS. It asks for the harness/provider, reads the key without echo,
fetches the key-scoped catalog, imports every model for that provider, retains unique
.bak-apitoken-* backups, preserves unrelated settings, and prints a private launcher. Use that
launcher for all seven clients. Missing npm clients install in a private directory; Node.js 22 LTS
and npm are prerequisites. Install Kimi Code or Hermes first; Windows Kimi Code/Pi also need Git
for Windows. Setup performs model discovery only, without a generation request.

- macOS and Linux: https://apitoken.sale/setup/connect.sh
- Windows PowerShell: https://apitoken.sale/setup/connect.ps1
- Other GUI/SDK clients: https://apitoken.sale/md/int; use the selected guide's field names and paths.

For persistent shell configuration, use the active shell's syntax and the user's consent. A running
process does not inherit later environment changes; restart the target process and verify there.
For PowerShell curl examples, use curl.exe; the old curl alias has different semantics.

## Verify within the budget

Start with free authenticated discovery and countTokens/count_tokens when supported. Before any
paid generation, prove a worst-case aggregate bound of at most 100000 nanoUSD ($0.0001), or obtain
explicit authorization for a larger aggregate budget. Include input, hidden/system/tool input,
cache miss, output, and billed tool units. Never infer a hard spending bound from a local output
clip: Codex max_output_tokens clips delivery and does not cap native generation. If a finite bound
cannot be proved, stop before paid traffic and report the missing bound or authorization.

Run one minimal generation from the target runtime using an exact discovered model. Confirm real
output and terminal authoritative usage; a model-list entry is not generation proof. Then verify the
target client. Add streaming/tools/images checks only when required and covered by the aggregate
budget. Never repeat a request after an ambiguous paid outcome or after public output starts.

## Diagnostic decision tree

- Network/TLS/timeout: inspect the exact runtime's network, DNS, clock, and proxy. A timeout after
  dispatch is an unknown paid outcome, not permission to retry.
- HTML/404: check the hostname, endpoint, and duplicated /v1. A model error needs fresh discovery.
- 401 or Gemini API_KEY_INVALID: check active customer key, whitespace, and the selected auth header.
  Replace a revoked key locally. Do not retry it.
- 400 documented_limitation/unsupported_parameter: use the named field's workaround. Do not repeat
  unchanged. 413/context errors need a smaller valid request within the selected model's limits.
- 402: check engine balance/spend limits. Backoff cannot fix money admission.
- 429: honor Retry-After. Retry only after a proven non-executed refusal and within the budget.
- 5xx or a lost response after dispatch: retain request ID/time, check https://apitoken.sale/status, and
  reconcile the outcome before another paid attempt. HTTP status alone does not prove no execution.
- Direct request works but the client fails: compare its actual config scope, inherited environment,
  provider mode, exact model, and outgoing URL. For SSE, inspect client parsing and intermediary buffering.

Full error reference: https://apitoken.sale/md/docs/errors.
Support: https://t.me/apitokensupportbot. Send only OS/client/runtime versions, exact endpoint/model,
HTTP status, redacted error, request ID, timestamp/timezone, and checks already performed.
API key: REDACTED (last four characters only). Never send passwords, card data, or full keys.

## Completion report

Report the detected client/runtime, active endpoint and exact model, changed settings/files,
verification and spend, restart/revert steps, and unresolved evidence. Claim a verified connection
only after a real response through the target client. If authorization or evidence is missing,
report configuration as prepared and name the remaining step; do not invent success.