TEE Router /Docs
Website
Documentation/TeeProxy setup

TeeProxy setup

Create an identity, verify Router and start your local API.

Let your local agent call models through a verified router.

Your agent TeeProxyTEE Router Official model service
1

Download the client and register a local ID

  1. From TeeProxy Releases ↗ download the Windows x64 package, extract all files, and run teeproxy.exe.
  2. In the left sidebar, open My Account , then click Register New ID . If you already have a local ID, select it from the list and click Use This ID .
  3. Check that your current user ID is displayed. In Top-ups & Withdrawals review available payment methods and your balance before making paid requests.
TeeProxy My Account page with local ID selection, Use This ID and Register New ID buttons
01 / My Account Register an ID, then use that local identity for subsequent requests. Click to enlarge.

Keep the client's data directory and the original Windows user environment. Identity keys on Windows are protected locally; copying files to another computer does not complete an identity migration.

2

Check the connection and verify the TEE

  1. Open Connection & Verification , and check the Router HTTPS address for your deployment.
  2. Use the appropriate TDX or SNP trust policy for the router type. Prefer a verified policy supplied with the release. For manual setup, obtain the matching files from project-approved release materials or the deployment operator.
  3. Save the configuration and run verification. Confirm success before starting the proxy; inspect diagnostics if verification fails.
What gets verified? The client checks TEE evidence, platform security state and software measurements allowed by the policy, and confirms that the TLS endpoint is bound to the evidence. A trust policy defines what is allowed to run. Do not copy measurements from an unknown node just to make verification pass.
TeeProxy Connection & Verification page showing the Router HTTPS address, TDX and SNP policy files, and verification controls
02 / Connection & Verification The router.example address and policy filenames are placeholders. Use your deployment's actual settings.
3

Choose a model and routing rules

Open Account Pools & Models to review merchants, model IDs, pool multipliers and availability. Copy the complete model ID for your agent; a display name alone is not enough.

  • Fixed pool: Use the interface's apply action to select your chosen merchant pool.
  • Automatic routing: In Routing Policy set the multiplier ceiling and priority rules, then save. Router will apply those rules when selecting a pool.
  • Check the price: The pool multiplier affects charges. Browsing or highlighting a row does not apply its routing settings.
TeeProxy Routing Policy page showing fixed pools, automatic routing, multiplier ceilings and routing priorities
03 / Routing Policy Save your rules before sending requests. Model permissions, authorization and available capacity also affect selection.
4

Start the local API

  1. Open Agent Connection . If the agent and TeeProxy run on the same computer, set the listening IP to 127.0.0.1 and use the default port 8899.
  2. Click Generate API Key , then use Copy API Key to save it in your agent configuration. You can also set 16–256 visible ASCII characters yourself. Both sides must use the same value; do not use the demo key in the screenshot.
  3. Save the settings and start the proxy. Confirm the listening address shown on the page, and keep TeeProxy running while using your agent.
TeeProxy Agent Connection page showing the listening IP, port, API key and Start Proxy button
04 / Agent Connection This API key authenticates only the local connection from your agent to TeeProxy. The screenshot uses a demo value.
5

Configure your agent

See the Codex and Claude Code configuration examples →

6

Check your first successful request

First check that the local API is reachable. Replace the key placeholder with your own value, then run:

PowerShell · Read the model catalog 
Invoke-RestMethod -Uri 'http://127.0.0.1:8899/v1/models' -Headers @{
  Authorization = 'Bearer YOUR_TEEPROXY_API_KEY'
}

A catalog response confirms that the local API is responding. Next, send a short request from your agent and check that you receive an answer. Review the connection in Runtime Logs and check the model, usage and charges in Usage Details . Actual model requests are charged under the platform's billing rules.

User setup complete TEE verified · Local API running · Agent received a model response