Quickstart

Get up and running with SignalVault in under 5 minutes.

1. Create an account and verify your email

Sign up for free, then open the verification email and click Confirm email address. The link has to be clicked, not merely opened, and expires after 24 hours — if yours has, the page offers to send a new one. You cannot reach the dashboard until the account is verified.

2. Create an app and generate an API key

After verifying, the dashboard prompts you to create your first app. The setup guide on the app page then lets you name a key, pick an environment, and generate it inline — you can also do this later from the app's Settings tab. Copy the key immediately; it is shown once and never again.

Keys are prefixed by environment: sk_live_ for production and sk_test_ for development and staging. Every plan can create keys in all three environments. The environment is taken from the key itself and decides which guardrail rules apply, so it cannot be overridden by a request header or body.

To rotate a key, generate a new one first, update your environment variables, then delete the old key — both stay valid until you delete the old one. An app can hold up to 10 active keys at once.

3. Send requests

Pick whichever approach fits your stack:

Option A: Proxy (recommended)

The fastest way to get started — no new packages required. Just point your existing OpenAI (or Anthropic) client at SignalVault's proxy by changing the baseURL:

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY,
  baseURL: 'https://api.signalvault.io/proxy/openai/v1',
  defaultHeaders: {
    'X-SignalVault-Key': 'sk_live_...',
  },
});

const response = await client.chat.completions.create({
  model: 'gpt-4o-mini',
  messages: [{ role: 'user', content: 'Hello!' }],
});

import Anthropic from '@anthropic-ai/sdk';

const client = new Anthropic({
  apiKey: process.env.ANTHROPIC_API_KEY,
  baseURL: 'https://api.signalvault.io/proxy/anthropic',
  defaultHeaders: {
    'X-SignalVault-Key': 'sk_live_...',
  },
});

const message = await client.messages.create({
  model: 'claude-sonnet-5',
  max_tokens: 1024,
  messages: [{ role: 'user', content: 'Hello!' }],
});

Every request is automatically logged, scanned, and governed — your application code stays unchanged. See the Proxy docs for supported providers and advanced options.

Option B: SDK (Node.js / Python)

Our SDKs wrap the OpenAI and Anthropic clients and send audit events for every request. They raise on a blocked prompt, so your application does not have to read the decision itself:

npm install @signalvaultio/node openai

import { SignalVaultClient } from '@signalvaultio/node';

const client = new SignalVaultClient({
  apiKey: 'sk_live_...',
  openaiApiKey: process.env.OPENAI_API_KEY,
  baseUrl: 'https://api.signalvault.io',
});

const response = await client.chat.completions.create({
  model: 'gpt-4o-mini',
  messages: [{ role: 'user', content: 'Hello!' }],
});

See the Node.js SDK or Python SDK docs for full details.

Option C: REST API

Send events directly to POST /v1/events from any language or HTTP client:

REQUEST_ID=$(uuidgen)

# 1. Before calling your provider — returns the guardrail decision.
curl -X POST https://api.signalvault.io/v1/events \
  -H "Authorization: Bearer $SIGNALVAULT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"type\": \"ai.request\",
    \"request_id\": \"$REQUEST_ID\",
    \"provider\": \"openai\",
    \"model\": \"gpt-4o-mini\",
    \"payload\": {\"messages\": [{\"role\": \"user\", \"content\": \"Hello!\"}]}
  }"

# {"event_id":"...","decision":"allow","violations":[],"redactions":[]}

# 2. After it responds — records the output, tokens and cost.
curl -X POST https://api.signalvault.io/v1/events \
  -H "Authorization: Bearer $SIGNALVAULT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"type\": \"ai.response\",
    \"request_id\": \"$REQUEST_ID\",
    \"payload\": {
      \"output\": \"Hi there!\",
      \"usage\": {\"prompt_tokens\": 10, \"completion_tokens\": 8}
    }
  }"

Works from Go, Rust, Java, Ruby, PHP — anything that can make an HTTP request.

See the API Reference for the full field list, every status code, and the two different 429 bodies.

That's it. Open your app in the dashboard and the request appears on the Requests page within a second or two, with its decision, tokens and cost. If you are checking whether a rule fired, read the decision rather than the status code: the events API answers 200 even for a blocked prompt, while the proxy answers 400.

What to expect on your first requests

A new app starts with PII and secret detection set to warn, and an 8 000-token limit set to block. A prompt containing an email address is therefore recorded as a violation and still goes through — that is the default, not a misconfiguration. See Guardrail rules to change it, and Plans & billing for what happens when the trial ends.