# AI Gateway quickstart

Runku AI Gateway gives IDEs and applications a compatible `/v1` endpoint while
provider credentials remain encrypted on the server.

## 1. Create a master key

```bash
export RUNKU_AI_MASTER_KEY=$(openssl rand -hex 32)
```

Keep this key stable and back it up securely. Losing it makes stored provider
credentials impossible to decrypt.

## 2. Start the gateway

```bash
runku-ai serve --config config.ai.yaml
```

The local administration portal is available at
`http://localhost:8088/portal/` by default.

## 3. Configure access

In the portal or CLI:

1. add a provider and its upstream credential;
2. enable one or more models;
3. create a consumer;
4. issue an `rk_ai_…` consumer key;
5. point the client to `http://localhost:8088/v1`.

Consumers never receive the upstream provider key.