AI Gateway - Overview
Route requests to every AI provider through one endpoint, with scoped access and a full audit trail on every call.
The SocketXP AI Gateway lets your applications call hosted AI providers, OpenAI, Anthropic, and Google (more to be supported in the future), alongside your own self-hosted models, through a single OpenAI-compatible endpoint.
Control who has access with scoped Access Keys, decide what each key is allowed to call with an Access Key Policy, and choose whether a request is served by your own provider key or by a model you run yourself.
Point any OpenAI SDK compatible client (Python, JavaScript, Go, or plain HTTP) at
https://ai-gateway.socketxp.com/v1 and route requests to OpenAI, Anthropic, Google, or
your own self-hosted models such as Ollama, vLLM, or LM Studio, without changing your
client code. Swapping providers becomes a change to the model field, not a
re-integration.
Why use the AI Gateway
Normally, every provider you add means another SDK, another base URL, and another raw API key sitting inside your client application. The AI Gateway collapses all of that into a single endpoint and a single scoped credential.
- You register your real provider API keys with SocketXP once, and they stay encrypted at rest, never handed out to client apps.
- Client apps only ever see a SocketXP Access Key, which you can scope to specific providers and models using an Access Key Policy.
- Models running on your own hardware, such as an Ollama or vLLM server, can be remotely accessed through a secure SocketXP tunnel and called through this same gateway endpoint, with no VPN, no public IP, and no public web URL required, and without that server ever being reachable on the public internet.
- And because every request passes through the gateway, every request gets logged, so you always know which model, provider, and policy handled a given call.
What you get
| Benefits | Details |
|---|---|
| One endpoint, every provider | Route to OpenAI, Anthropic, Google, or self-hosted models without changing client code. |
| One access key, fully scoped | Issue scoped Access Keys instead of handing out raw provider API keys, and attach a Policy to restrict provider or model access per key. |
| Bring your own provider keys (BYOK) | Register your own OpenAI, Anthropic, or Google keys once. They're encrypted at rest and never exposed to your client applications. |
| Keep self-hosted models private | Expose a local model server through a secure tunnel, reachable only through the gateway. No VPN, public IP, or public web URL needed. |
| Full audit trail | Every request is logged with its model, provider, and policy, and shows up in Event Logs. |
| Drop-in OpenAI compatibility | Works with the official OpenAI SDKs and plain HTTP or cURL. Just change the base_url. |
How a request flows through the gateway
Your app talks to the gateway using an Access Key, exactly the way it would talk to OpenAI directly. From there, the gateway figures out where the request actually needs to go:
- If the
modelyou asked for belongs to a built-in provider like OpenAI, Anthropic, or Google, the gateway swaps in your BYOK key and forwards the request to that provider's API. - If the
modelbelongs to one of your own custom providers, the gateway forwards the request over a private SocketXP tunnel to your self-hosted server instead.
Either way, your client never sees a real provider key, and the provider never sees your SocketXP Access Key.
Get started
Head to the Quickstart to create an Access Key, register a provider, and make your first request in a few minutes. If you'd rather understand the building blocks first, start with Concepts.