Skip to main content

Coder

Wire AI coding agents (such as Claude Code) running inside Coder workspaces to your Agent Router gateway. Each developer stores their own Agent Router API key as a Coder user secret, and a platform admin adds one coder_env block to the workspace template — so every workspace routes through the gateway with per-developer spend attribution, budgets, and revocation out of the box.

How it works​

Coder is a self-hosted cloud development environment: a platform admin owns the workspace template (Terraform), and each developer owns their workspaces built from it. The integration splits along that line:

  • Developer (once): store your Agent Router API key as a Coder user secret. Coder injects it as ANTHROPIC_API_KEY into every workspace you own — the key never touches the template or version control.
  • Platform admin (once per template): add one coder_env resource that sets ANTHROPIC_BASE_URL to the Agent Router gateway URL. The URL is not a secret, so it is safe to commit with the template.

Because each developer brings their own key, requests from workspaces appear in Agent Router request logs attributed per developer.

Requires Coder v2.34 or later (user secrets; available in Coder OSS — no Premium license needed). Works with any Agent Router gateway: Agent Router Service or an Enterprise (self-managed) data plane.

The fastest path for the developer half is Configure coding tools with the tare CLI. After tare api login and a coder login against your Coder deployment, preview then apply:

tare integrate dataplanes
tare integrate coder --dry-run --dataplane <dataplane-id>
tare integrate coder --dataplane <dataplane-id>

The command resolves your gateway URL, reuses (or mints) an Agent Router API key, stores it as the Coder user secret for you, and prints the coder_env template block to hand to your platform admin. If the coder CLI is not installed or not logged in, it prints complete manual instructions instead of failing.

The manual steps below achieve the same thing.

Step 1 (developer): store your API key as a Coder user secret​

Log in to your Coder deployment, then pipe your Agent Router API key into a user secret (stdin keeps it out of shell history):

coder login https://coder.example.com
printf '%s' 'your-tars-api-key' | coder secret create tars-api-key \
  --env ANTHROPIC_API_KEY \
  --description 'Tetrate Agent Router inference key'

Use coder secret update tars-api-key instead if the secret already exists. You can also create it in the Coder dashboard under Account > Secrets > Add secret — set the name, the ANTHROPIC_API_KEY environment variable target, and paste your key as the value:

Add secret dialog with name tars-api-key and environment variable ANTHROPIC_API_KEY

Either way, the secret shows up with its environment-variable target, enabled for injection:

Coder user secret tars-api-key with env target ANTHROPIC_API_KEY

Coder injects the secret as ANTHROPIC_API_KEY into every workspace you own, at workspace start.

Step 2 (platform admin): point workspaces at the gateway​

Add this to the workspace template (the URL is not a secret, so it is safe to commit):

# Routes Anthropic-protocol agents (Claude Code, ...) in every workspace
# through Tetrate Agent Router.
resource "coder_env" "anthropic_base_url" {
  agent_id = coder_agent.main.id
  name     = "ANTHROPIC_BASE_URL"
  value    = "https://your-gateway.example.com"
}

Replace the value with your gateway proxy host — for Agent Router Service, the gateway URL from the Console Dashboard; for Enterprise, your data plane's proxy endpoint. Use the host only, not a full /v1/messages URL: Anthropic clients append the path automatically.

Push the template (coder templates push). The block is visible in the template's Source Code view:

The coder_env block in the template Source Code view

Every workspace built from it now routes Anthropic-protocol traffic through Agent Router.

Step 3: verify from inside a workspace​

Start (or restart) a workspace so the secret and template env are injected:

A running Coder workspace built from the updated template

Open a terminal in it and check both halves landed, then run your agent as usual — for example claude (Claude Code picks up ANTHROPIC_BASE_URL and ANTHROPIC_API_KEY automatically):

printenv ANTHROPIC_BASE_URL
test -n "$ANTHROPIC_API_KEY" && echo "ANTHROPIC_API_KEY is set (injected by Coder user secret)"
claude -p "Reply with exactly: routed through Agent Router"

Terminal in the workspace: env vars injected and Claude Code answering through Agent Router

You can also probe the gateway directly:

curl "$ANTHROPIC_BASE_URL/v1/models" -H "x-api-key: $ANTHROPIC_API_KEY"

Requests appear in your Agent Router request logs, attributed to your API key — per-developer spend, budgets, and revocation work out of the box because each developer stores their own key:

Agent Router request logs attributing the workspace traffic to the developer&#39;s API key

Notes and limitations​

  • Restart to pick up changes: user secrets are injected at workspace start. After creating or updating the secret, restart running workspaces.
  • The secret follows you everywhere: Coder injects user secrets into every workspace you own on that deployment. If some of your workspaces must talk to Anthropic directly, unset ANTHROPIC_API_KEY/ANTHROPIC_BASE_URL in those, or scope templates accordingly.
  • Don't use template parameters for keys: Coder displays parameter values in cleartext across the product and recommends against them for secrets. User secrets exist for exactly this.
  • OpenAI-protocol tools: this guide covers the Anthropic protocol. OpenAI-shape tools inside workspaces can use the same pattern with a second secret (--env OPENAI_API_KEY) and a coder_env for the OpenAI-compatible base URL (your gateway URL with /v1).
  • Coder AI Gateway is not the mechanism: Coder's own AI Gateway (a Premium add-on) would demote Agent Router to an upstream provider. This integration deliberately uses plain environment wiring instead — it needs only Coder OSS.