Management Plane onboarding
Onboard a Fully Managed deployment through a one-time Admin Dashboard wizard: organization details, SSO, providers, and models. Complete Steps 1–4, then skip Step 5 (Service Account / data-plane credential) and click Complete setup. Tetrate already runs the data plane, so you do not create, download, or regenerate data-plane credentials.
The onboarding wizard
The wizard launches automatically on the first sign-in to the Admin Dashboard; there is no separate onboarding URL. Each step has Next and Previous controls. Next is enabled once the current step's required fields are filled; Previous returns to any earlier step to review or change a value.
Step 1
Organization Name
Identify the tenant and set the data-plane URL.
Step 2
Corporate Login
Configure SSO over OpenID Connect (OIDC). For evaluations without corporate IdP admin access, use Auth0 as a temporary IdP.
Step 3
LLM Providers
Connect providers such as OpenAI and Anthropic.
Step 4
LLM Models
Choose which models are exposed.
The wizard may still show Step 5: Service Account (data-plane credential). That step is only for Self-Hosted Data Plane installs. On Fully Managed, do not click Create Service Account, Regenerate Credential, or any equivalent credential button, and do not download service-account.json. Advance past Step 5 and click Complete setup.
Plan for 15 to 30 minutes, plus any back-and-forth with the identity provider (IdP) team during Step 2.
Prerequisites
Have the following on hand before launching the wizard. Step 2 is hard to complete without the IdP details:
- Access to the Admin Dashboard. Tetrate provides the URL during provisioning.
- Initial admin credentials for the first sign-in. SSO is configured in the wizard; the first login uses these credentials.
- OIDC IdP details: issuer URL, client ID, client secret, scopes. Agent Router supports OIDC only; SAML and other protocols are not supported. For an evaluation without IdP admin access, use the Set up Auth0 for evaluation path instead.
- An IdP administrator reachable during Step 2. The wizard shows a redirect URI that must be registered on the IdP side before SSO works.
- API credentials for at least one LLM provider, for example an OpenAI API key.
- The data-plane hostname Tetrate assigned for the deployment, for example
proxy.example.com. This becomes the Data plane URL in Step 1; Tetrate operates the data plane at the hostname registered here.
Get started
The wizard appears automatically when the Admin Dashboard URL is first visited.
Click Start setup to begin.
Step 1: configure organization name
Fill in:
| Field | Required | Description | Sample value |
|---|---|---|---|
| Organization Name | Yes | The organization's display name | Acme Corp. |
| Data plane URL | Yes | The hostname for the Tetrate-operated data plane. Always include the scheme (for example https://proxy.example.com, not proxy.example.com). | https://proxy.example.com |
The data plane is operated by Tetrate. Enter the assigned hostname here, then confirm the same proxy endpoint is attached to the default project after you sign in with SSO.
Step 2: configure corporate login (single sign-on)
SSO lets users sign in with the organization's existing identity provider.
Use Auth0 as a temporary IdP rather than the corporate IdP. The Set up Auth0 for evaluation guide is the full spine: create the tenant, copy the Redirect URI from this step, register the Auth0 app, and paste the credentials back into this form.
Agent Router supports OIDC only. SAML, LDAP, and other protocols are not supported.
At Step 2, the wizard displays the OIDC redirect URI for the deployment, following the pattern:
https://dashboard.<your-mp-host>/login
Register Agent Router as an OIDC application in the IdP using that exact URI as an authorized redirect URI. Once the IdP-side application is registered and the issuer URL, client ID, and client secret are in hand, fill in:
| Field | Required | Description | Sample value |
|---|---|---|---|
| Issuer (IdP URL) | Yes | OIDC issuer URL exposed by the IdP | https://login.example.com/ |
| Client ID | Yes | OAuth client ID created for Agent Router | agent-router |
| Client Secret | Yes | OAuth client secret paired with the Client ID | •••••••• |
| Discovery URL | No | OIDC discovery document URL. If omitted, Agent Router constructs it as <Issuer URL>/.well-known/openid-configuration. Provide it only if the IdP serves discovery at a non-standard path. | https://login.example.com/.well-known/openid-configuration |
| Scopes | Yes | OAuth scopes to request | openid profile email |
| Admin email | Yes | At least one user granted admin rights after the first SSO login | [email protected] |
| Attribute mapping | Yes | Maps an IdP claim to the Agent Router user's email. The typical value is email. | email |
See the SSO configuration guide for details.
If SSO is misconfigured and blocks sign-in, sign back in with the initial admin credentials and reset the SSO configuration from the Admin Dashboard settings panel.
Step 3: configure LLM provider(s)
Connect Agent Router to one or more LLM providers. At least one provider is required to route traffic.
The wizard shows a radio button for each supported provider, including OpenAI, Anthropic, Google, Azure OpenAI, Mistral, Cohere, Together, and Perplexity. See Provisioning models and providers for the authoritative list. Select a provider, click Configure, then fill in:
| Field | Required | Description | Sample value |
|---|---|---|---|
| Display Name | No | Optional label shown in tables and filters | OpenAI |
| API Base URL | Yes | Base URL for the provider API. Pre-filled for supported providers. | https://api.openai.com/v1 |
| Auth method | Yes | Authentication method. Pre-filled per provider. | API Key |
| Secret Type | Yes | Password for single-string API keys; Service Account JSON for providers that authenticate with a JSON credential file. | Password |
| Provider Secret | Yes | API key, token, or service-account JSON. Use Rotate in the UI to replace a stored secret without clearing the rest of the form. | sk-proj-... |
| Enable provider | Yes | Toggle on to expose the provider with this configuration. | toggle |
Repeat for each provider to expose. The wizard returns to the provider selection screen after each one is saved.
Step 4: configure LLM models
The wizard shows a single list of all models Agent Router supports, maintained by Tetrate. By default, a selective set of common models is enabled. Deselect models to control cost, meet data-handling requirements, or scope to the intended use case. Models remain configurable later from the Admin Dashboard. If a required model is missing, contact Tetrate support.
Custom model entries are not configurable in onboarding.
Step 5: skip the service account (Fully Managed)
On Self-Hosted Data Plane, Step 5 downloads a service-account.json credential used to install your own data plane. Fully Managed does not use that step.
What to do:
- If the wizard shows Service Account / data-plane credential, skip it—do not create, regenerate, or download a JSON file.
- Continue to the completion screen.
Tetrate operates the data plane for this tier; there is nothing to install locally with that credential. Regenerating the credential is a rotation operation for the managed data plane and can break it. If it is regenerated by mistake, contact Tetrate to restore service.
Complete the process
After Steps 1–4 (and skipping Step 5), click Complete setup to finish onboarding.
The Admin Dashboard can now be accessed by signing in with SSO.
Before the first request
After signing in with SSO, confirm the default project is ready before handing the deployment to developers:
- Open the default project's Gateway tab and check its default gateway's endpoint. Right after onboarding it is often empty; if so, edit that gateway and set the endpoint to the proxy host Tetrate assigned (for example
https://proxy.example.com). A data plane can host several gateways, so set the endpoint on the gateway the default project uses. - Confirm your admin user is a member of the project.
- Confirm at least one provider is connected and enabled.
- Open the project-scoped Models page and confirm the models developers should call are linked and enabled.
- In the Dev Console, create an Inference key for gateway requests. Do not use an Admin Dashboard organization/API key for inference traffic.