Connect in 5 minutes

Path A · Proxy (recommended)

Swap the base URL, set the headers — done. Your provider key stays your key and is only passed through.

from anthropic import Anthropic
client = Anthropic(base_url="https://tokenwacht.de/anthropic", api_key=os.environ["ANTHROPIC_API_KEY"],
                   default_headers={"X-TW-Key": "tw_live_…", "X-TW-Agent": "nils-icp-research", "X-TW-Run": run_id, "X-TW-Kunde": "customer-4711"})

from openai import OpenAI
client = OpenAI(base_url="https://tokenwacht.de/openai/v1", default_headers={"X-TW-Key": "tw_live_…", "X-TW-Agent": "…"})

# Gemini: base URL https://tokenwacht.de/gemini (keep x-goog-api-key)   ·   Bedrock: https://tokenwacht.de/bedrock/model/<id>/converse

Header	Required	Meaning
`X-TW-Key`	yes	Your Tokenwarden key. Nothing is forwarded without it.
`X-TW-Agent`	recommended	The agent as a durable unit, e.g. `nils-icp-research`.
`X-TW-Run`	recommended	Run id (UUID or text). If missing, runs are formed automatically (15 minutes of silence = new run).
`X-TW-Step`, `X-TW-Kunde`, `X-TW-Funktion`, `X-TW-Benutzer`	optional	Step, end customer (re-billing), function, user.

Rejection (HTTP 402)

{"fehler": "tokenwacht_budget_ueberschritten", "regel": "lauf_budget", "grenze": "2.5000", "verbraucht_eur": "2.5400", "schritte": 41, "lauf_id": "…", "hinweis": "…", "cockpit_url": "…"}

Path C · SDKs, n8n, Claude Code

# Python
from tokenwacht_sdk import Wacht, BudgetUeberschritten
wacht = Wacht(schluessel="tw_live_…", agent="nils-icp-research", kunde="customer-4711")
client = Anthropic(api_key=…, base_url=wacht.anthropic_url(), http_client=wacht.http_client())

// Node
const { Wacht } = require("tokenwacht-sdk");
const wacht = new Wacht({ schluessel: "tw_live_…", agent: "nils-icp-research" });
const client = new Anthropic({ baseURL: wacht.anthropicUrl(), fetch: wacht.fetch });
await wacht.lauf("RL-0815", { budgetEur: 2.5 }, async (lauf) => { … });

n8n: community package n8n-nodes-tokenwacht (start run, report usage, fetch consumption). Claude Code: a Stop hook reports every session as a run — see sdk/claude-code-hook/.

Path D · Ingest API

POST https://tokenwacht.de/v1/ereignisse
Authorization: Bearer tw_live_…
{"ereignisse": [{"ereignis_id": "…", "zeitpunkt": "2026-09-05T10:00:00Z", "anbieter": "anthropic", "modell": "claude-sonnet-5",
  "agent": "nils-icp-research", "lauf_id": "…", "eingabe_token": 1200, "ausgabe_token": 57, "cache_lese_token": 800, "status": "erfolgreich"}]}

Read consumption (API for other systems)

GET https://tokenwacht.de/v1/api/verbrauch?gruppe=endkunde&von=2026-09-01&bis=2026-10-01
Authorization: Bearer tw_live_…

Rules and levels

Six rule types: run budget, daily budget per agent, monthly budget, rate limit, model block with time window, protection rule per detector. Every rule starts in shadow mode — measured, not enforced — until you arm it.

Enterprise: SSO, audit log, self-hosting

SSO via OpenID Connect (Entra ID, Okta, Authentik, Keycloak): issuer, client id, client secret and your e-mail domains in the cockpit under Account. Every write action lands in the audit log (CSV export). Self-hosting: Docker Compose or Kubernetes with the same images; a licence key unlocks the Enterprise functions.