Govern Claude Code without switching to managed API keys

Every governed AI gateway we know of makes the same trade: to see your developers' traffic, it replaces their credentials with a company API key — and silently converts flat subscriptions into pay-per-token billing. This page explains why that happens, what it costs, and the mechanism we use instead.

Sentilai · August 2026

The trade nobody prices in

A developer on Claude Pro pays $20/month, flat. On Max, $100–200/month, flat. The same developer's workload, billed at API list rates, runs $150–250/month on Anthropic's published averages — and heavy agentic use runs to multiples of that, because agents retry, branch and re-read context in ways nobody types by hand.

So for a ten-developer team, the gateway you installed for governance quietly rewrites the AI bill:

That difference is not a gateway fee. It is the billing model changing underneath you, and it usually surfaces one invoice later.

Why gateways do this

It is not malice; it is the path of least resistance. Across every AI provider we checked, the auth model works the same way: when a request carries an explicit credential, that credential is billed — and subscription billing no longer applies. A proxy that injects a company API key therefore works on the first try, for every tool, with one key to manage. The cost of that convenience lands on your Anthropic invoice, at per-token list rates.

The alternative requires the gateway to not hold a credential at all — which is harder to build, because now the gateway must authenticate devices some other way, and must forward the developer's own credential without breaking it.

The governed path, mechanically

Here is exactly what Sentilai does with Claude Code, so you can judge it rather than trust it:

• The Endpoint Suite sets ANTHROPIC_BASE_URL to the Sentilai gateway. No credential is injected, ever. Claude Code keeps its own claude.ai OAuth session as the active credential, so subscription billing still applies.
• Attribution rides in a custom header carrying the device's identity — a hardware-backed key in the OS keychain, per person and per device. The gateway authenticates on that header, not on the Anthropic credential.
• The gateway forwards Authorization, anthropic-beta and anthropic-version byte-for-byte unchanged. That last detail matters: stripping anthropic-beta breaks the OAuth capability and the request dies with a 401 — which is how you can tell whether a vendor has actually built this or is describing a diagram.
• Policy runs while the request is in flight: secrets, personal data, prompt injection and exfiltration-pattern detectors, per-MCP-server and per-tool rules. A blocked request never leaves the governed path.

What we record is the audit trail: who, which device, which tool, which model, what the policy decided, token counts. Prompt and response content is recorded only if the tenant explicitly turns capture on — it is off by default, and your traffic is never training data.

The honest per-tool truth table

Subscription pass-through is not equally possible everywhere, because providers expose different hooks. Claims of "keep your subscriptions" that don't name the tool are hiding this table:

If a vendor tells you all five of those keep their subscriptions, ask them for this table.

What you give up

On the governed path: nothing measurable. Same subscription, same models, same speed class — the gateway adds policy evaluation in-flight, not a second model call. What changes is that requests transit an EU-hosted gateway, your admins get an activity view, an evidence pack and real-time blocking, and a developer's access dies with their device enrollment the day they leave.

What we deliberately do not do: resell tokens, mark up usage, or meter requests. Sentilai is priced per seat band, flat — the pricing is public — because a governance product with a token margin has an incentive problem.