The gateway
convention

One rule

Every service on Squiid is reached the same way:

https://api.squiid.io/v1/<service>/<the provider's own path>

Authorization: Bearer $SQUIID_API_KEY

The service segment is the service slug, for example supabase, resend, openai or twilio. Everything after it is the provider own path, unchanged. Request bodies, response bodies, status codes and error shapes are the provider own, which means provider documentation stays correct and your agent already knows how to use it.

Why it is shaped this way

A coding agent that has to learn a new abstraction per service is slower and wronger than one that learns a single rule. By keeping the provider path and payloads intact, the only thing an agent must know is the host and the header. Everything it already knows about the Supabase client or the OpenAI SDK remains true.

With an SDK

// OpenAI
const ai = new OpenAI({
  baseURL: 'https://api.squiid.io/v1/openai',
  apiKey: process.env.SQUIID_API_KEY,
});

// Anthropic
const claude = new Anthropic({
  baseURL: 'https://api.squiid.io/v1/anthropic',
  apiKey: process.env.SQUIID_API_KEY,
});

// Supabase
const db = createClient('https://api.squiid.io/v1/supabase', process.env.SQUIID_API_KEY);

With plain fetch

const res = await fetch('https://api.squiid.io/v1/resend/emails', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SQUIID_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    from: 'hello@yourdomain.com',
    to: 'someone@example.com',
    subject: 'Sent through Squiid',
    html: '<p>One key.</p>',
  }),
});

With curl

curl https://api.squiid.io/v1/openai/chat/completions \
  -H "Authorization: Bearer $SQUIID_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4.1-mini","messages":[{"role":"user","content":"ping"}]}'

Put it in your agent rules

Paste this into whichever file your agent reads as project context:

# Services
All third-party calls go through the Squiid gateway.
Base URL: https://api.squiid.io/v1/<service>/
Header:   Authorization: Bearer $SQUIID_API_KEY
Never add provider-specific API keys to this repo.

That is CLAUDE.md for Claude Code, AGENTS.md for Codex, .cursor/rules for Cursor, .windsurf/rules/ for Windsurf, .clinerules for Cline, GEMINI.md for Gemini CLI and .github/copilot-instructions.md for GitHub Copilot. Agent-specific notes are on each agent page.

Errors

The gateway returns the provider status and body wherever it can. Where the problem is on the Squiid side, you get a clear status instead: authentication failures for a bad or revoked key, a payment-required response when the credit balance cannot cover the call, and a not-found response when the service segment names something you have not added to your account.

Keys

Keys are prefixed sq_live_. You can hold several, scoped per project or per agent, so the dashboard shows which key made which call. Rotating a key is a click and does not touch upstream provider credentials, which is the whole point: a leaked gateway key is worth nothing outside the gateway and costs you one click, not an afternoon.