Skip to main content

Xcode with the Gateway

Only Xcode features that let you choose an OpenAI-compatible endpoint can send model traffic through Keeptrusts. Apple's on-device predictive completion does not make an upstream HTTP request, so there is nothing for the gateway to intercept.

GitHub Copilot for Xcode added bring-your-own-key (BYOK) support in version 0.50.0. Use that path only when the app's Model providers settings let you enter a custom OpenAI-compatible base URL. Ordinary GitHub-hosted Copilot traffic is not redirected by Keeptrusts.

Prerequisites​

  • GitHub Copilot for Xcode 0.50.0 or later with BYOK available for your installation.
  • A completed Gateway Setup for IDEs.
  • A Keeptrusts client API token and a model configured on the gateway.

The client token authenticates the Xcode extension to the gateway. It is separate from both the connected-gateway runtime token and the upstream provider credential.

Add the gateway as a model provider​

In the GitHub Copilot for Xcode app:

  1. Open Settings, then Model providers.
  2. Add a provider that accepts an OpenAI-compatible HTTP endpoint.
  3. Set the base URL to http://127.0.0.1:41002/v1.
  4. Enter a Keeptrusts client API token as the API key.
  5. Enter or select the exact model identifier exposed by the gateway.
  6. Select that provider and model for the BYOK interaction you want to govern.

The available fields and feature coverage are owned by the installed Copilot version. If its provider screen does not accept a custom base URL, that build cannot use the Keeptrusts model endpoint; do not substitute operating-system proxy settings.

Verify the governed path​

Before testing in Xcode, verify the same token and model directly:

export KEEPTRUSTS_IDE_TOKEN="kt_..."

curl -fsS \
  -H "Authorization: Bearer $KEEPTRUSTS_IDE_TOKEN" \
  http://127.0.0.1:41002/v1/models

Then follow events and trigger the BYOK-backed action in Xcode:

kt events tail --since 10m --follow

The matching Keeptrusts event is the proof that the action used the configured gateway. Test chat, agent, and completion behavior separately: support for one Copilot surface does not prove that every Xcode feature uses the same provider.

Traffic that is not governed​

Xcode surfaceKeeptrusts coverage
Apple predictive completionNone; inference is on-device.
GitHub-hosted Copilot requestsNone; the extension uses GitHub's service.
Copilot BYOK request using the Keeptrusts base URLGoverned when a matching Keeptrusts event is recorded.
Another extension with a custom OpenAI-compatible endpointGoverned only for interactions explicitly assigned to that endpoint.

Troubleshooting​

SymptomCheck
No custom endpoint fieldUpdate the extension and confirm BYOK is available for that Copilot surface.
Connection refusedConfirm kt gateway status and port 41002.
401 UnauthorizedConfirm the Model providers entry uses an active Keeptrusts client token.
Model rejectedCompare the configured name with the authenticated /v1/models response.
Xcode responds but no event appearsCheck gateway event delivery, the CLI organization and region, the event window and filters, then confirm the action uses the BYOK provider rather than a GitHub-hosted model.

Next steps​