Gateway Quickstart

The d3cipher Gateway is a Docker container you deploy in your own infrastructure. Your AI agents talk to it instead of directly to OpenAI, Anthropic, or any other provider. The gateway enforces governance policies — audit trail, kill switch, token budgets, encrypted transcripts — without touching a single line of agent code.

Your prompts and responses never leave your network in plaintext. Only cryptographic stamps and encrypted blobs reach the d3cipher cloud. The server cannot read your content. Only your Account Key can decrypt it.

  Your Agent          d3cipher Gateway            AI Provider
  (no changes)        (your network)              (OpenAI, etc.)
      |                     |                          |
      |--- API request ---->|                          |
      |                     |-- stamp (metadata) ----->| d3cipher Cloud
      |                     |-- encrypt body --------->| (can't read it)
      |                     |                          |
      |                     |--- forward request ----->|
      |                     |<-- provider response ----|
      |                     |                          |
      |                     |-- stamp response ------->| d3cipher Cloud
      |                     |-- encrypt response ----->| (can't read it)
      |<-- response --------|                          |
      |                     |                          |
                

Setup

docker login registry.gitlab.com -u deploy-yourcompany -p your-registry-token

# Gateway (production middleware — runs as a service)
docker pull registry.gitlab.com/d3cipher/lockstock-images/gateway:v3.1.0

# Admin-Tools (compliance CLI — run on-demand)
docker pull registry.gitlab.com/d3cipher/lockstock-images/admin-tools:v3.1.0

# Install Liberty
pip install liberty-secrets

# Store your LockStock keys (one time)
liberty add LOCKSTOCK_GATEWAY_KEY "lsk_gateway_..."
liberty add LOCKSTOCK_ACCOUNT_KEY "85d7a50b..."
liberty add LOCKSTOCK_UPSTREAM_URL "https://api.openai.com"
liberty add OPENAI_API_KEY "sk-..."

# Provision an agent and start the gateway (reads keys from Liberty)
lockstock-gateway provision --name MY_AGENT
lockstock-gateway start

docker run -d --name d3cipher-gateway \
  -e D3CIPHER_API_KEY=lsk_gateway_your_key_here \
  -e UPSTREAM_URL=https://api.openai.com \
  -e ACCOUNT_KEY=your_64char_hex_account_key \
  -p 4000:4000 \
  registry.gitlab.com/d3cipher/lockstock-images/gateway:v3.1.0

curl http://localhost:4000/healthz
# {"status": "ok", "agents_active": 0, "inflight": 0}

# Before (direct to OpenAI)
OPENAI_BASE_URL=https://api.openai.com

# After (through d3cipher Gateway)
OPENAI_BASE_URL=http://gateway-host:4000

X-D3cipher-Agent: customer-support-bot

What You Can Do From the Dashboard

What d3cipher Never Sees

Two Containers, One Install

LockStock ships two Docker images built from the same codebase. They share the same cryptographic libraries but have a hard trust boundary between them:

Admin-Tools: Audit & Key Rotation

The admin-tools container provides two CLI commands for compliance officers:

# Decrypt and read agent transcripts
docker run --rm registry.gitlab.com/d3cipher/lockstock-images/admin-tools:v3.1.0 \
  lockstock-audit \
    --account-key "your-64-char-hex-key" \
    --agent-id "agent_0d20202e_claude_d3cipher" \
    --api-key "lsk_admin_..." \
    --format json

# Rotate your Account Key (re-wrap all agent encryption keys)
docker run --rm registry.gitlab.com/d3cipher/lockstock-images/admin-tools:v3.1.0 \
  lockstock-rotate \
    --old-key "current-64-char-hex-key" \
    --new-key "new-64-char-hex-key" \
    --api-key "lsk_admin_..." \
    --dry-run

lockstock-audit fetches encrypted blobs from the d3cipher cloud, unwraps the encryption keys using your Account Key, and outputs the plaintext transcripts locally. Nothing is sent back to the server. lockstock-rotate re-wraps all encryption keys under a new Account Key — use it if your Account Key is compromised or as part of a regular key rotation policy.

Deployment Options

Docker Compose

version: "3.8"
services:
  d3cipher-gateway:
    image: registry.gitlab.com/d3cipher/lockstock-images/gateway:v3.1.0
    ports:
      - "4000:4000"
    environment:
      D3CIPHER_API_KEY: "${D3CIPHER_GATEWAY_KEY}"  # lsk_gateway_* (stamp-only)
      UPSTREAM_URL: "https://api.openai.com"
      ACCOUNT_KEY: "${ACCOUNT_KEY}"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4000/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3

Kubernetes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: d3cipher-gateway
spec:
  replicas: 1
  selector:
    matchLabels:
      app: d3cipher-gateway
  template:
    metadata:
      labels:
        app: d3cipher-gateway
    spec:
      containers:
      - name: gateway
        image: registry.gitlab.com/d3cipher/lockstock-images/gateway:v3.1.0
        ports:
        - containerPort: 4000
        env:
        - name: D3CIPHER_API_KEY
          valueFrom:
            secretKeyRef:
              name: d3cipher-secrets
              key: api-key
        - name: UPSTREAM_URL
          value: "https://api.openai.com"
        - name: ACCOUNT_KEY
          valueFrom:
            secretKeyRef:
              name: d3cipher-secrets
              key: account-key
        livenessProbe:
          httpGet:
            path: /healthz
            port: 4000
          initialDelaySeconds: 5
          periodSeconds: 30
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
---
apiVersion: v1
kind: Service
metadata:
  name: d3cipher-gateway
spec:
  selector:
    app: d3cipher-gateway
  ports:
  - port: 4000
    targetPort: 4000
  type: ClusterIP

Endpoints

Troubleshooting

Gateway returns 400 "Missing X-D3cipher-Agent header": Either set AGENT_ID on the container for a default, or add the X-D3cipher-Agent header to each agent's HTTP requests.

Gateway returns 429 "Token budget exhausted": The agent's token budget is depleted. Go to the dashboard, increase the budget or click Unlock to reset the counter.

Gateway returns 409 "Chain hash mismatch": The agent's chain has forked — a duplicate agent, a replay attempt, or a cloned credential. This is a hard stop. Investigate immediately.

Gateway returns 503 "LockStock stamp rejected": The circuit breaker has tripped (velocity anomaly or manual lock). Check the dashboard for the reason. Click Unlock to restore access.

/healthz returns 503: The gateway can't reach the d3cipher cloud. Check network connectivity and LOCKSTOCK_URL if set.

Agents not appearing in dashboard: Make sure the agents are actually sending requests through the gateway (check OPENAI_BASE_URL points to the gateway, not directly to OpenAI).

Transcripts show "Blob not available": The ACCOUNT_KEY environment variable wasn't set when those requests were processed. Set it and future transcripts will be encrypted and stored.

Next Steps

• Compliance Quickstart — for compliance officers setting up governance policies
• API Reference — REST endpoints for fleet management, audit logs, and provisioning
• Open Dashboard — manage agents, set budgets, audit transcripts
• hello@d3cipher.ai — enterprise plans, on-premise deployment, or integration support