Configuration

This is the consolidated lookup table for configuring the client side of Unyform — the env vars, flags, and files you set on your own machine. Nothing here is a secret you hand to Unyform: your provider keys stay yours (BYOK), and the gateway settings that govern a request live in the dashboard, summarized at the bottom.

The four surfaces, and what each one configures:

Surface	You set	Covered in
Gateway routing	A base-URL env var so your tool's inference flows through Unyform	Point Claude Code
MCP server / CLI	`UNYFORM_*` vars + project/credential files	Use the MCP server
CC plugin	One install command; an auth file holds the rest	Use the Claude Code plugin
The gateway itself	Dashboard toggles (providers, policies, …)	Create a gateway

Gateway routing (point a tool at the gateway)

Routing is one base-URL variable. Your tool keeps talking its provider's native protocol; Unyform exposes the same protocol at your gateway URL.

Variable	Set it to	Notes
`ANTHROPIC_BASE_URL`	`https://gateway.unyform.ai/gw/<gateway-id>`	Claude Code and the Anthropic SDK
`OPENAI_BASE_URL`	`https://gateway.unyform.ai/gw/<gateway-id>`	OpenAI SDK; gateway serves `/v1/chat/completions`
`ANTHROPIC_API_KEY`	your own key — unchanged	Forwarded upstream verbatim, never stored (BYOK)
`OPENAI_API_KEY`	your own key — unchanged	Same — your credential, your bill

Note

You keep setting your provider key exactly as before. The gateway forwards your ANTHROPIC_API_KEY / OPENAI_API_KEY (or OAuth credentials) to the upstream provider and never persists them. The only thing that changes is the base URL.

The <gateway-id> in the URL is configuration, not a secret — it identifies your org's gateway. Set the base URL per shell with export, or per project in .claude/settings.json under "env".

MCP server & CLI

The unyform-mcp server and the unyform CLI read the same three settings, resolved flag → environment → project config, in that order:

Setting	Flag	Environment	Falls back to
Org	`--org-id`	`UNYFORM_ORG_ID`	`org_id` in `.unyform/config.yml`
API URL	`--api-url`	`UNYFORM_API_URL`	`https://api.unyform.ai`
Auth	—	`UNYFORM_API_KEY`	`~/.unyform/credentials.json`

Files

Path	Created by	Contents
`~/.unyform/credentials.json`	`unyform login`	`{ "api_key": "..." }`, mode `0600` on Unix
`.unyform/config.yml`	`unyform init --org-id <id>`	Per-project `org_id`, optional `gateway_id`, `api_url`

A .unyform/config.yml looks like this — only org_id is required:

org_id: <org-id>
# optional overrides:
# gateway_id: <gateway-id>
# api_url: https://api.unyform.ai

The server walks up from the current directory to find the nearest .unyform/config.yml, so any subdirectory of a project inherits its org.

Tip

Authenticate once with unyform login to write the credentials file, or export UNYFORM_API_KEY in the environment your MCP client launches the server in. The key is sent as a bearer token and is never embedded in the config you paste into your editor.

Registering the server

The same three settings can be passed via the client's MCP config. Per tool:

claude mcp add unyform -- unyform-mcp --org-id <org-id>

{
  "mcpServers": {
    "unyform": {
      "command": "unyform-mcp",
      "args": ["--org-id", "<org-id>"]
    }
  }
}

[mcp_servers.unyform]
command = "unyform-mcp"
args = ["--org-id", "<org-id>"]

Add --debug to the args to log tool calls to stderr. See Use the MCP server for the full tour.

Claude Code plugin

The mx cc-plugin plugin needs no env vars in normal use — install writes its auth config for you. The one input is a per-gateway key:

mx cc-plugin install --api-key uny_gw_your_key_here

What	Where
Auth config	`~/.config/unyform/cc-plugin.json` (Linux) / `~/Library/Application Support/unyform/cc-plugin.json` (macOS), mode `0600`
Hook entries	`~/.claude/settings.json` (`SessionStart`, `Stop`)
Key source	`--api-key` flag, or `UNYFORM_API_KEY` if the flag is omitted
Base URL	`https://gateway.unyform.ai` by default; override with `--base-url` for staging/dev

The uny_gw_… key resolves to exactly one gateway, so the plugin knows which blueprints to serve with no further config. See Use the Claude Code plugin.

Gateway-side settings (dashboard)

Everything that governs a request — which providers are allowed, whether BYOK passthrough is on, which blueprints inject, and how policies enforce — is configured per gateway in the dashboard, not on your machine.

Setting	Where	What it controls
Providers	Providers tab	Anthropic / OpenAI / Azure / Google / Custom, default model, priority
Passthrough	Per-provider toggle	Whether clients may route with their own (BYOK) key
Blueprints	Blueprints tab	Which blueprints inject, and their priority
Policies	Policies tab	Which org policies attach to this gateway
Enforcement mode	Per-policy	Enforce (block), Warn (log, pass), or Disabled
API keys	API Keys tab	Mint / revoke `uny_gw_…` keys for the gateway

Note

A gateway with no policies still injects blueprints and context — it just doesn't gate requests.

For the full walkthrough, see Create & configure a gateway.

Edit this page on GitHub

← MCP tools CLI →