One Gateway.
Your APIs.
Gatekeeper routes OpenAI, Anthropic, OpenAI-compatible AI, and registered public HTTPS REST requests through one control panel. It encrypts saved upstream credentials, applies rate and budget checks, and records usage metadata for processed calls.
OpenAI
Anthropic
OpenAI-compatible
Registered REST
Why It Exists
The Problems It Solves.
✕ Provider keys copied into each app
→ Saved upstream credentials are vaulted per tenant. Client apps use separate tenant gateway keys.
✕ Unbounded usage from runaway loops
→ AI calls reserve estimated spend before processing; REST calls can have atomic per-service monthly quotas. Provider pricing and tokenization mean budgets remain estimates, not a guaranteed provider-billing ceiling.
✕ No shared rate checks across services
→ Sliding-window checks are scoped to a tenant (or JWT user). If Redis is unavailable, requests fail open and rate limiting is temporarily bypassed.
✕ Limited usage visibility
→ The customer dashboard shows recent AI model, token, estimated-cost, and result records. REST request metadata is retained for operator diagnostics; rejected requests are not all recorded.
Request Flow
How Gatekeeper Works.
Provision a Tenant
Create an instance with an App ID and monthly budget. Each instance can have tenant-bound gateway keys, encrypted provider credentials, and usage history.
Route Your Requests
Point your app, workflow, or script at the proxy endpoint. Pass your gateway key and App ID as headers — everything else is handled at the gate.
Monitor & Enforce
Review available usage records and adjust instance settings. AI calls reserve estimated spend before processing; usage records show estimated costs after the response completes.
Defense Layer
Security at the Boundary.
Protocol 01
Dual Auth Modes
Tenant-bound gateway keys for server integrations and Gatekeeper-issued Supabase JWTs for instance owners. Both are checked before an upstream call.
Protocol 02
Rate Limiting
Per-tenant sliding-window limits use Upstash Redis. They fail open during Redis errors. Login attempts are separately limited to 5 per 15 minutes per IP when Redis is available.
Protocol 03
Payload Validation
Provider allowlist, model checks, message bounds (max 100), per-message length limits (32K chars), and max_tokens capped at 8192 — before anything fires upstream.
Protocol 04
Budget and quota checks
AI calls reserve estimated spend atomically; REST quotas atomically count admitted requests. Budget and quota database failures block temporarily. Upstash rate checks fail open during Redis errors.
Reference
Frequently Asked.
What is Gatekeeper?+
A proxy for OpenAI, Anthropic, OpenAI-compatible AI endpoints, and registered public HTTPS REST services. It stores upstream credentials encrypted, authenticates callers, applies rate and budget checks, and records usage metadata for requests that reach its logging points.
Which APIs can it proxy?+
Gatekeeper supports OpenAI and Anthropic through their APIs, OpenAI-compatible chat-completion endpoints, and registered public HTTPS REST upstreams. REST requests are limited to 10 MB and supported HTTP methods; private-network targets are blocked. AI usage costs are estimates based on token counts and configured model rates. REST quotas atomically count admitted attempts, including upstream failures.
How does authentication work?+
Clients can send a per-tenant gateway key (shown once and stored as a hash) or a JWT issued by Gatekeeper’s Supabase Auth. Gateway keys are scoped to one tenant, and JWT callers can access only instances they own. Keep credentials in a trusted server environment.
How are costs and usage controlled?+
Before an AI call, Gatekeeper reserves an estimated cost against month-to-date usage and active reservations; concurrent requests are serialized in the database. A budget-check or quota-counter failure blocks the request temporarily. Final cost is estimated from token counts and configured model rates, so budgets are guardrails—not a hard ceiling on third-party billing. Per-minute rate checks still fail open during an Upstash outage.
Are my API keys safe?+
Saved upstream credentials are encrypted at rest with AES-256-GCM and decrypted server-side for calls. The dashboard shows a masked suffix after saving. Client apps use separate tenant gateway keys rather than the upstream provider credential.
What problems does it solve?+
Gatekeeper centralizes upstream credentials, request routing, rate checks, budget guardrails, and AI usage summaries. REST request metadata is recorded for operator diagnostics but is not currently shown in the customer dashboard. It does not store prompt or response bodies, and records are not a complete audit of every rejected request.
Pricing
Simple Plans.
Starter includes a 7-day free trial. No card charged until it ends.
Request limits are assigned when an instance is created. Changing plans does not currently update existing instances.
Starter
7-day free trial included
- ▸3 tenants
- ▸Gateway key auth
- ▸Credential vault
- ▸LLM + REST proxy
- ▸30 req/min per instance
- ▸Your own provider spend
Pro
No trial
- ▸10 tenants
- ▸Everything in Starter
- ▸100 req/min per instance
- ▸Your own provider spend
Scale
No trial
- ▸Unlimited tenants
- ▸Everything in Pro
- ▸500 req/min per instance
- ▸Your own provider spend
Enterprise
SoonNot yet available
- ▸Everything in Scale
- ▸Dedicated onboarding
- ▸Custom rate limits
- ▸MSA + SLA
- ▸SSO / SAML
- ▸Volume pricing
Ready to Deploy