# Fast track evaluation

> Evaluate Agent Router on the Fully Managed tier in an afternoon: sign in, route real AI traffic through the gateway, and read back exactly what it costs. Self-contained, nothing to install.

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# Fast track evaluation

  Evaluate the Fully Managed tier in an afternoon: first routed request in about 15 minutes after onboarding; a small team and cost readout by the end of the day. Nothing to install.

## What this evaluation covers

Tetrate Agent Router is an [AI gateway](/product-architecture/product-overview/#product-overview) between applications or coding agents and providers (OpenAI, Anthropic, and others). One OpenAI-compatible endpoint handles routing, credentials, cost, and policy; every request is recorded and attributed to the key that made it.

On the [Fully Managed tier](/#which-is-right-for-you), Tetrate runs both the [management plane](/product-architecture/planes-and-components/#operating-model) and the [data plane](/product-architecture/planes-and-components/#core-components-of-the-data-plane), so the evaluation starts at first sign-in.

Results are only convincing on real traffic, so the fast track routes work that is already being paid for: an existing provider account via Bring Your Own Key (BYOK), or a Claude Pro/Max plan via [passthrough mode](/reference/glossary/#passthrough-mode) through the gateway. Upstream billing stays as before, and Agent Router observes and attributes the traffic. Nothing is locked in, and the evaluation can be stopped at any point.

By the end, the environment produces:

- Real traffic flowing through the gateway, still billed upstream as before (BYOK or Claude Code [passthrough mode](/reference/glossary/#passthrough-mode)).
- A cost and token breakdown per request, model, and key, with a monthly projection.
- A budget with a live meter, and multiple teammates routing through the same gateway.

The result is the raw material for a rollout decision: what current AI usage actually costs, where it goes, and how it compares across a team.

## Before beginning

:::info Want to know more about Agent Router?
- Check the [product overview](/product-architecture/product-overview/) page for more information.
- Or, consult the [where to begin](/where-to-begin/) page as a starting point.
:::

The fast track assumes the following are on hand.  
Note: URLs below use `<tenantID>` for the tenant hostname segment Tetrate assigned; Fully Managed evaluation tenants look like `tare-pn-<xxxxxxxx>` (for example `tare-pn-a1b2c3d4`).

- **The Admin Dashboard URL** Tetrate provided for the evaluation tenant, for example `https://dashboard.tare-pn-<tenantID>.tetrate.ai`. The Admin Dashboard is the operator view: onboarding, identity, providers, models, budgets, and Agent Router settings.
- **The Dev Console URL** Tetrate provided for the evaluation tenant, for example `https://router.tare-pn-<tenantID>.tetrate.ai`. The Dev Console is the developer view: API keys, the Base URL, request logs, and usage.
- **The Gateway URL** Tetrate assigned for the evaluation tenant, listed in the provisioning email, for example `https://proxy.tare-pn-<tenantID>.tetrate.ai`. Nothing is entered with it during onboarding; the same value appears automatically as the **Base URL** in the Dev Console once setup is complete.
- **An LLM provider API key**, for example an OpenAI or Anthropic key. It is added once during onboarding (Step 1), and that key routes real traffic on its own. Adding a **BYOK** key (Step 3) is optional, and is only needed to bill each person's spend to their own provider account. Alternatively, a Claude Max or Pro subscription, for Claude Code **[passthrough mode](/reference/glossary/#passthrough-mode)** instead.
- **An identity provider**. An [Auth0](https://auth0.com) account works well for an evaluation and takes minutes to set up; corporate IdP admin access can be used instead where it is available and approved. *Learn how to set up Auth0 [here](/product-architecture/product-evaluation/auth0-for-evaluation/)*.
- **A terminal or HTTP client** (curl, Python, or Postman) for the first request.

## Step 1: Initial sign in and onboard (Admin Dashboard) {#sign-in-and-onboard}

Access is the first thing the evaluation establishes, because every later action happens under a real signed-in identity. The first sign-in launches a one-time [onboarding](/agent-router-enterprise/fully-managed/onboarding/) wizard that configures the organization: single sign-on, at least one provider, and the models to expose.

Single sign-on is configured up front for two reasons. It puts the evaluation on the same footing as a real deployment from the start, and it turns teammate onboarding later in the fast track into a single shared link with no separate account administration. Auth0 is recommended for an evaluation because it stands up an identity provider in minutes without waiting on corporate IT. The configuration is identical to a corporate IdP, so nothing about the evaluation changes if the tenant later moves to permanent corporate SSO.

1. Open the **Admin Dashboard** URL (`https://dashboard.tare-pn-<ID>.tetrate.ai`) in a web browser of choice. 
1. The first sign-in launches a welcome screen and the onboarding wizard. 
1. Click button **Start setup** to begin the onboarding. Row numbers in the table below match the wizard screens.

<details className="alert alert--success tare-collapsible-tip">
<summary>No corporate IdP access? Use [auth0.com](https://auth0.com) for evaluation SSO</summary>

Only change the settings listed below. Leave everything else at its default.

1. At [auth0.com](https://auth0.com), sign up and create a tenant. Go to **Applications → Create Application → Regular Web Application**. Leave **"This application is owned by a third party"** toggled **off**: this cannot be changed later, and enabling it breaks sign-in.
1. Enter a name, such as `agent-router-<tenantID>` and click **Create** .
    - *Note: Replace `<tenantID>` with the actual ID, which is visible in the dashboard URL*.
1. From tab **Settings**, copy the **Domain**, **Client ID**, and **Client Secret** to a text editor or note taking app.
1. Scroll down to Application URIs. Set **Allowed Callback URLs** to `https://auth.tare-pn-<tenantID>.tetrate.ai/api/auth/sso/callback/corporate`, and **Allowed Web Origins** to these three hostnames (`https://auth.tare-pn-<tenantID>.tetrate.ai`, `https://dashboard.tare-pn-<tenantID>.tetrate.ai`, `https://router.tare-pn-<tenantID>.tetrate.ai`), followed by clicking button **Save** . 
    - *Note: Replace `<tenantID>` with the actual ID*.
1. Create an admin user: **User Management → Users → Create User** with a controlled email address. Use this email as an **Admin email** in the wizard below. If it is skipped, the first sign-in lands as a non-admin user with no in-product way to fix it.

Full walkthrough: [Set up Auth0 for evaluation use](/product-architecture/product-evaluation/auth0-for-evaluation/).

</details>

| Wizard step | Section           | What to do |
| :---------- | :---------------- | :--------- |
| 1           | Configure Organization Name | Set **Organization Name**. On Fully Managed there is no data-plane hostname to enter here, because Tetrate already runs the data plane and its gateway. The resulting **Base URL** appears later, in the Dev Console. |
| 2           | Configure Corporate Login   | **No corporate IdP access?** Expand the Auth0 tip above and use those Domain / Client ID / Client Secret values here.Fill in the OIDC values from **the IdP** (not Tetrate):- **Issuer**: `https://<idp-domain>/` (trailing slash)- **Client ID**: `<provided by IdP>` - **Client Secret**: `<provided by IdP>` - **Scopes**: `openid profile email`- **Admin emails**: at least one administrator email address, added as a default project member. Optional; add members later from the Admin Dashboard (default project → **Members**) if skipped.- **Attribute mapping**: Set to `email`.- **Role Mapping (optional)**: skip for now.Click button **Next**. |
| 3           | Configure LLM Provider Keys | Enable at least one (1) provider (for example OpenAI or Anthropic).- Click button **Enable** on an accessible provider.- Enter the API key into the **Provider secret** field and click button **Rotate** to persist it.- Toggle **Enable provider** to **on**.- Click button **Save**. |
| 4           | Configure LLM Model | Review the model list.- Leave the defaults as is, or (de)select as needed.- This can be changed later in the Admin Dashboard. |
| 5           | Review AI Gateway   | Nothing to configure. Tetrate already provisioned the gateway, so this step only reports its status.Click button **Next**, which is enabled regardless of the status shown (see [what each status means](/agent-router-enterprise/fully-managed/onboarding/#step-5-review-ai-gateway)). |
| 6           | Complete          | Click button **Complete setup** to close the onboarding wizard. |

:::important Fully Managed credential handling
Tetrate manages the installed data-plane credential for Fully Managed deployments, and there is no credential control in the onboarding wizard to regenerate it. Later, from the Admin Dashboard's project **Gateway** tab, regenerating a data-plane credential is a rotation operation that can break the managed data plane. If it is regenerated by mistake, contact Tetrate to restore service.
:::

After onboarding, sign out, then sign back in with SSO as the admin user.

Onboarding sets up the default project automatically: the gateway URL, the providers connected in wizard step 3, and the models selected in wizard step 4 are already in place. Project membership comes from Step 2's Admin email field. A quick look confirms all of it:

### Confirm the default project (optional)
1. Log in to the **Admin Dashboard** (`https://dashboard.tare-pn-<tenantID>.tetrate.ai`).
1. In the left-hand sidebar, navigate to **Directory → Projects**.
1. Select the **default** project from the list of projects.
    - Note: at this point, only the default project will be visible.
1. Select tab **Gateway** and confirm the default gateway's **endpoint** matches the Gateway URL from the provisioning email. The value is already set, with nothing to configure.
1. Select tab **Members** and confirm the admin user is listed.
1. Select tab **Providers** and confirm the providers connected during onboarding are listed and enabled.
1. In the top-left corner, switch to project **default**, navigate to **Catalog → Models**, and confirm the models selected during onboarding are linked and enabled.

If something looks wrong, for example an expected provider is not listed, each tab above allows a direct fix with **Add to project** or **Grant access** as needed.

**Outcome**  
The Admin Dashboard loads under SSO, the default project points at the managed gateway endpoint, and the configured providers and models are available to the project.

**Relevant resources**
- [Management Plane onboarding](/agent-router-enterprise/fully-managed/onboarding/)
- [Set up Auth0 for evaluation use](/product-architecture/product-evaluation/auth0-for-evaluation/)

## Step 2: route the first request (Dev Console) {#first-request}

Before any real traffic runs, a single request confirms the path end to end. Two things are created here. The **Base URL** is the OpenAI-compatible URL that fronts every configured provider; applications point at it instead of at a provider directly. The **API key** is the credential a client presents to the gateway, and it is also the unit that request logs, usage, and budgets attribute to, so it is worth naming keys meaningfully.

Because the endpoint is OpenAI-compatible, most existing code and SDKs work by changing only the base URL and the key. The `curl` and Python examples below are the same request expressed two ways.

### Create an API key
1. Open the Dev Console (`https://router.tare-pn-<tenantID>.tetrate.ai`) in a web browser. If needed, log in using the account set up in step 1.
1. In the left-hand sidebar, navigate to **Settings → API Keys**.
1. Click button **Add API Key**. 
1. Set field **Key type** to **Inference key** from the drop-down list.
1. Enter a Key name (e.g. `eval-dev-key1`)
1. Click button **Create key**.
1. From the popup, copy the values of **Your API key** and **base URL** to a text editor or note taking app.
    - The API key will not be visible again, so verify it has been copied before continuing.
1. Click button **Done**. 
1. Note the **Base URL** is displayed at the top of the page.
    - This is the project's gateway endpoint, provisioned automatically by Tetrate rather than entered during onboarding, usually with `/v1` appended, for example `https://proxy.tare-pn-<tenantID>.tetrate.ai/v1`.

### Test the API key
1. Send a request using curl or Python.
    - In the code examples, replace `YOUR_BASE_URL` and `YOUR_API_KEY` with the values copied earlier.
    - In the code examples, replace `gpt-4o` with any model in the catalog.

<Tabs>
  <TabItem value="curl" label="curl" default>

```bash
export AGENTROUTER_API_KEY="<YOUR_API_KEY>"
export BASE_URL="<YOUR_BASE_URL>"

curl ${BASE_URL}/chat/completions \
  -H "Authorization: Bearer $AGENTROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o",
    "messages": [{"role": "user", "content": "Hello, world!"}]
  }'
```
  </TabItem>
  <TabItem value="python" label="Python">
```python
from openai import OpenAI

client = OpenAI(base_url="<YOUR_BASE_URL>", api_key="YOUR_API_KEY")
resp = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello, world!"}],
)
print(resp.choices[0].message.content)
```
  </TabItem>
</Tabs>

**Expected result:** a completion, and the request in the Dev Console under **Monitoring → Request Logs** with the model, token counts, cost, and latency.

Example `curl` output:  
```bash
{"id":"msg_011CdLiqXzSDUMMYvVKFSGnW","choices":[{"finish_reason":"stop","index":0,"message":{"role":"assistant","content":"Hello! 👋 It's nice to meet you. How can I help you today?"}}],"created":1234567890,"model":"claude-haiku-4-5-20251001","object":"chat.completion","usage":{"completion_tokens":23,"prompt_tokens":11,"total_tokens":34}}
```

**Relevant resources**
- [Make an API call](/agent-router-service/quickstarts/make-an-api-call/)
- [Quickstart: the Dev Console](/agent-router-service/quickstarts/quickstart-console/)

## Step 3: put real traffic through the gateway (Dev Console) {#your-real-traffic}

The synthetic request in Step 2 proves the plumbing; this step makes the evaluation convincing by running real work, a coding task or an agent run, through the gateway. The provider key added during onboarding already routes that traffic, so a client can be pointed at the proxy directly. The two paths below only change *whose* provider bill the tokens land on; pick one if it applies.

### Optional: Bring Your Own Key (per-person billing)

**Bring Your Own Key (BYOK)** registers a provider API key already in use (OpenAI, Anthropic, and others), so the provider bills that account instead of the org key from onboarding. Use it to put each person's spend on their own provider invoice, or to reach a provider the onboarding key does not cover. The gateway measures and attributes the traffic; it does not rebill those tokens. This is not Claude Code passthrough mode; that path is below.

1. In the Dev Console, go to **Settings → Bring Your Own Key** and add credentials for a provider already in use. Credentials are encrypted at rest and never returned.
1. Point a coding agent or OpenAI-compatible client at the gateway. Use the **Base URL** from Step 2 and the **Agent Router API key** (not the provider key added above).

```bash
# Example: OpenAI-compatible client (Base URL includes /v1)
export OPENAI_BASE_URL=https://proxy.tare-pn-<tenantID>.tetrate.ai/v1
export OPENAI_API_KEY=YOUR_AGENT_ROUTER_API_KEY
```

Cursor and similar tools take the same two values in their settings. For Claude Code **without** a Max/Pro subscription (managed Anthropic credentials on the gateway, not passthrough mode), follow [Connect Claude Code → Option A (managed mode)](/agent-router-service/guides/coding-agents/claude-code/connect/#option-a-managed-mode-agent-router-managed-anthropic-key): proxy host without `/v1`, and the Agent Router API key in `ANTHROPIC_API_KEY`.

1. Run a real task with the agent or client.

**Expected result:** the requests in Dev Console **Monitoring → Request Logs**, attributable to the Agent Router key.

### Alternative: Claude Code [passthrough mode](/reference/glossary/#passthrough-mode) (Pro or Max subscription)

**Passthrough mode** keeps the flat Claude Max or Pro subscription fee in place while Agent Router Enterprise monitors the traffic through Request Logs, usage, and the Admin Dashboard Spend overview. Anthropic still authenticates the session with Claude Code's stored OAuth token, and the gateway routes and observes without putting those tokens on Agent Router billing. In the Spend overview, **passthrough usage** is the theoretical API-rate cost that traffic would carry without the subscription, and it does not count toward the budget. This is separate from BYOK: a Claude subscription is **not** pasted into Bring Your Own Key.

1. Follow [Connect Claude Code → Option B (passthrough mode)](/agent-router-service/guides/coding-agents/claude-code/connect/#option-b-passthrough-mode-an-existing-claude-max-subscription): 
    - From a command prompt, type `claude /login`
    - Leave `ANTHROPIC_API_KEY` unset
    - Set `ANTHROPIC_BASE_URL` to the proxy host and `ANTHROPIC_CUSTOM_HEADERS` with `x-tars-api-key` (the Agent Router API key from Step 2).
1. Start a session (type `claude` from a command prompt) and run a real task. 
    - Confirm with `/status` that the Anthropic base URL is the proxy host. 
    - In Request Logs, these requests are labeled **passthrough**.

**Expected result:** passthrough-labeled requests in Dev Console **Monitoring → Request Logs**, attributable to the Agent Router key.

**Relevant resources**
- [Use your own provider credentials](/agent-router-service/guides/use-your-own-provider-credentials/)
- [Coding agents and tools](/agent-router-service/guides/coding-agents/)
- [Connect Claude Code](/agent-router-service/guides/coding-agents/claude-code/connect/) (Option A managed, Option B passthrough)

## Step 4: see what the traffic costs (Admin Dashboard) {#see-the-cost}

With real traffic flowing, cost questions move to the **Admin Dashboard**. Under the sidebar **Usage** section, start with **Analytics** to baseline spend. Step 5 attaches a personal budget under **Budgets** and reads the **Spend overview** (billed against the ceiling; an optional **passthrough** line if Claude Code passthrough mode was used). That matches [Keep team spend inside a ceiling](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/keep-team-spend-inside-a-ceiling/) and [See budget exhaustion coming](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/see-budget-exhaustion-coming/).

### Baseline cost in Analytics

Before a ceiling is useful, read the same dimension the budget will use.

1. Open the Admin Dashboard (`https://dashboard.tare-pn-<tenantID>.tetrate.ai`) in a web browser. If needed, log in using the account set up in step 1.
1. Ensure **Organization** level is selected in the top left corner.
1. In the left-hand sidebar, navigate to **Usage → Analytics**.
1. Select tab **Cost**.
1. Use the drop-down box (top right corner) to set a time range that covers the traffic from Step 3 (for example last 24 hours or last 7 days).
1. Use the drop-down box directly next to the search box and select **Group by Mode** to visualize model usage across managed, BYOK, and passthrough traffic by request count, tokens, and estimated cost, per key, model, and provider.
    - Once additional users are added, **Grouping by User or Team** provides critical insight into model usage across developers. 

Size any monthly ceiling from this baseline: above normal burn, below a number that would be a problem. A first evaluation budget can start tight, and can be raised later.

Write down a monthly projection (a representative day × working days, or a week × about 4.3). That list-price-style figure is the evaluation's cost signal, comparable to a subscription price or a direct-provider invoice.

**Expected result:** a user row in Cost with tokens and estimated spend, enough to size a personal ceiling in Step 5.

**Relevant resources**
- [Keep team spend inside a ceiling](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/keep-team-spend-inside-a-ceiling/)
- [Read the shadow bill](/agent-router-enterprise/guides/observability-and-analytics/usage-analytics-onboarding/read-the-shadow-bill/) (Dev Console view of list-price cost on passthrough traffic)

## Step 5: set a budget for one user (Admin Dashboard) {#set-a-budget}

With a Cost baseline from Step 4, attach a ceiling to a single user's billed spend. Use the **One person** scope: a monthly USD limit on that user alone, independent of any team.

### Create a budget
1. Open the Admin Dashboard (`https://dashboard.tare-pn-<tenantID>.tetrate.ai`) in a web browser. If needed, log in using the account set up in step 1.
1. Ensure **Organization** level is selected in the top left corner.
1. In the left-hand sidebar, navigate to **Usage → Budgets**.
1. Click button **Add budget**.
1. Set **Scope** to **One person**. 
1. Select the user (use search if the list is long).
1. Set **Spend limit** to a given amount in USD (for example, sized from the Analytics Cost baseline in Step 4), or pick a preset ($100, $500, $1,000, …). 
    - The budget resets at the start of each calendar month (UTC); a mid-month create still applies to spend already in that month.
1. Name it (for example `Eval personal cap`) and review the summary.
1. Click button **Create budget**.
1. Verify the new budget is listed in the overview.

### Read the Spend overview

1. In the left-hand sidebar, navigate to **Usage → Budgets**.
1. Open the budget created in the previous steps. 
    - The detail view has configuration on the left (scope, name, spend limit, **Active**) and **Spend overview** on the right.
1. Read the headline meter.
    - **billed** spend against the ceiling (for example `$36.01 of $100.00 · monthly`), plus **Used**, **Remaining**, and **Days left**.
    - Only **billed** amounts count toward the limit and drive alerts.
1. If **Claude Code passthrough mode** was configured in Step 3 and that traffic was sent, look for **passthrough usage (not counted toward budget)** under the meter.

**Claude Code passthrough mode** keeps Max/Pro paying the flat subscription fee. The **passthrough** line is the theoretical cost of those same requests **without the subscription**, priced at standard API rates (`≈`). It is for scale and comparison only; it never draws down the budget. On a team **per user** budget, each member row can show **billed** next to **passthrough** the same way, with the member's billed amount against their cap.

**If Claude Code passthrough mode was not configured**, the Spend overview stays simpler: billed against the ceiling, progress bar, Used / Remaining / Days left, with no passthrough line.

**Expected result:** the budget under **User Budgets**, **Active**, with billed on the meter. A passthrough `≈` total appears only after Claude Code passthrough traffic.

**Relevant resources**
- [Keep team spend inside a ceiling](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/keep-team-spend-inside-a-ceiling/)
- [See budget exhaustion coming](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/see-budget-exhaustion-coming/)
- [Raise a spend ceiling](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/raise-a-spend-ceiling/)

## Step 6: bring in teammates (Admin Dashboard and Dev Console) {#bring-teammates}

A single user proves the mechanism; a small group turns it into decision material. Cost and usage patterns only become comparable when there is more than one person to compare, so this step repeats the personal setup for a handful of the heaviest AI users on the team. Those users produce the most representative spread, and the SSO configured in Step 1 makes onboarding them a matter of a shared link. The payoff is team-level attribution: spend broken down by team, model, and application, which is the evidence a rollout decision rests on.

### Create two or more users
Additional users must be created on the IdP (identity provider) so they can sign in with single sign-on. On a corporate IdP, follow the administrator's standard user-provisioning process instead of the steps below.

For Auth0 (from Step 1):

1. Navigate to https://auth0.com and sign in.
1. In the left-hand navbar, select **User Management → Users**.
1. Click button **Create User** and select **Create via UI**.
1. Set **Connection** to **Username-Password-Authentication**.
1. Enter an email for the new user (e.g. `elmer.fudd@acme.com`) and set a strong password.
1. Click button **Create Another** and repeat the process one or more times.
1. End by clicking button **Create**.

### Set up for users and teams
1. Share the Dev Console URL (`https://router.tare-pn-<tenantID>.tetrate.ai`) with the users just created
1. Have them sign in with SSO using the email address and password entered in the previous steps. 
1. Each user appears in the Admin Dashboard under **Directory → Users**, after their first login.
1. Each teammate repeats **Step 3: BYOK** with their provider API key, or Claude Code **passthrough mode** if they use Claude Max/Pro.
1. Assign each team a budget under **Usage → Budgets** (Whole team or Each teammate), sized from the Analytics baseline in Step 4 and the personal ceiling from Step 5. 

**Expected result:** spend comparable across teammates by model and app, with each team's meter drawing down.

**Relevant resources**
- [Onboard developers and issue keys](/agent-router-enterprise/guides/operate-and-govern/onboard-developers-and-issue-keys/)
- [Use your own provider credentials](/agent-router-service/guides/use-your-own-provider-credentials/)

## Go deeper (optional)

The fast track leaves behind a working environment and a first set of numbers. The following pages build on it:

- [Graded evaluation scenarios](/product-architecture/product-evaluation/evaluation-scenarios/): a scored scorecard for a structured, comparable decision.
- [Configure SSO](/agent-router-enterprise/guides/identity-and-access-management/single-sign-on/sso-configuration-guide/): move off the temporary Auth0 tenant to permanent corporate SSO.
- [Guides for Developers](/agent-router-service/guides/) and [Guides for Platform Operators](/agent-router-enterprise/guides/operate-and-govern/): the full task-by-task reference.