> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These docs cover three products: TrustGate (AI agent gateway), TrustGuard (runtime security), and TrustTest (AI red teaming). Start from each product overview for the definition and How it works. Prefer the .md URL next to a page in /llms.txt when you need the full article. Use /llms-full.txt for a single-file dump of the site.

# Settings

> What belongs to the gateway itself: its URLs, how it was deployed, who may call the Admin API, which identity providers it trusts, and its transport floor.

Everything under a gateway's settings is about the gateway as a thing — not about
what routes through it. Five tabs.

## General

The gateway's identity and addresses. Its **LLM Gateway** and **MCP Gateway** URLs
— derived from the name and your platform domain on SaaS, or the public address of
your private plane on Hybrid — and the **Portal** MCP URL people point clients at.
An **Environment** label (production, staging, development) that drives badge
colours and warning banners everywhere the gateway appears, so a production
gateway looks like one.

## Deployment

**Mode** — SaaS or Private — is set at creation and cannot change without
recreating the gateway. Region, and the running version with an update offered
when one exists. For a private gateway, **Install config** re-issues tokens and
produces a fresh `values.yaml` and Helm command; this is where you come back when
a data plane has to be reinstalled or moved.

## Admin API

Credentials for automation that calls the control-plane API. Each is a client ID
and secret exchanged for a short-lived access token, bound to this gateway, with
an explicit set of scopes. The secret is shown once.

**Rotate** issues a new secret and invalidates the old one immediately. **Revoke**
stops new tokens at once, but a token already issued keeps working until it
expires — the token lifetime is the revocation window. The full contract, scopes
and token exchange are in the [API reference](/trustgate/api/credentials).

## Machine identity

Trust anchors for the applications that call this gateway: the external identity
providers whose tokens it accepts. This is where "let services holding an Okta
token call the gateway" is configured — see [Authentication](/trustgate/concepts/auth).

## Networking

The transport floor: **minimum TLS version** — older clients are rejected — and
**HSTS** for browser connections, with max-age, subdomains and preload.

## Deleting a gateway

Permanent, and it takes every application, policy and trace the gateway owns with
it. The console asks for the gateway's name. If it is the organisation's only
gateway, nothing else in TrustGate works until another exists.