Use the gateway

Quickstart

1. Create an account, or claim a self-hosted installation.
2. Add a provider key and test it.
3. Create a route for the model your app will request.
4. Issue a virtual key and copy it. It is shown once.

SDK examples

Replace the key and model with the values from your dashboard.

curl https://keysquay.theserverless.dev/v1/chat/completions \
  -H "Authorization: Bearer kq_live_…" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","stream":true,"messages":[{"role":"user","content":"Hello"}]}'

from openai import OpenAI
client = OpenAI(base_url="https://keysquay.theserverless.dev/v1", api_key="kq_live_…")
client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello"}],
)

import OpenAI from "openai";
const client = new OpenAI({ baseURL: "https://keysquay.theserverless.dev/v1", apiKey: "kq_live_…" });
await client.chat.completions.create({
  model: "gpt-4o-mini",
  messages: [{ role: "user", content: "Hello" }],
});

Embeddings use POST https://keysquay.theserverless.dev/v1/embeddings with model and input.

Providers

Named providers use their public endpoints. OpenAI-compatible providers are forwarded as-is. Anthropic chat is translated to the Messages API. Bedrock is signed for the OpenAI-compatible Bedrock Runtime path. A custom connection needs the base URL you enter. The provider key is encrypted with a workspace data key and is not shown again. The dashboard keeps the last 4 characters.

Routing

A route is a model pattern, such as gpt-4o* or *, pointed at a provider connection. Lower priority numbers are tried first. KeysQuay falls back when the provider returns 429 or 5xx, or when the request times out. A virtual key only sees routes in its workspace. An allowlist can narrow that further.

Limits

Each workspace has a request-per-minute limit. The default is 600. Set 0 for no workspace limit. Each virtual key can set its own requests per minute, a daily or monthly token quota, and a daily or monthly cost-estimate budget. These limits are approximate. Requests already in flight can exceed them. Expiry and revoke take effect on the next request.

Self-host

Set KQ_MODE=selfhost (the default). On first run, open /setup and enter the ADMIN_TOKEN plus an email and password. That creates the operator account for the default workspace. The header X-Admin-Token still authorizes the admin API on a self-hosted install. Public sign-up stays off.

Hosted mode is KQ_MODE=cloud. See the repository file docs/HOSTED.md for secrets, email, OAuth, and Turnstile.