Skip to content

AI Model Gateway

AI Model Gateway exposes OpenAI-compatible model APIs behind OpenEdge authentication, billing, usage logs, cost limits, and Connected Accounts.

Supported Endpoints

Required scope:

text
ai:invoke
http
POST /v1/apps/ai/:alias/chat
POST /v1/apps/ai/:alias/chat/stream
POST /v1/apps/ai/:alias/embeddings

BYOK Provider Model

The current MVP supports BYOK. Users bring their own OpenAI-compatible provider key, either directly on the AI service instance or through a Connected Account.

Supported Connected Account provider types:

text
openai-compatible
openrouter
deepseek
custom-api-key

Service Configuration

Direct API key mode stores an encrypted provider key:

json
{
  "provider": "openai-compatible",
  "mode": "byok",
  "base_url": "https://api.openai.com/v1",
  "default_model": "gpt-4o-mini",
  "api_key_encrypted": "enc:v1:...",
  "max_tokens_per_request": 2048,
  "max_cost_per_request": 0.05,
  "log_requests": false
}

Connected Account mode stores a reference instead:

json
{
  "provider": "openai-compatible",
  "mode": "byok",
  "connected_account_id": "conn_...",
  "base_url": "https://openrouter.ai/api/v1",
  "default_model": "anthropic/claude-sonnet",
  "max_tokens_per_request": 4096,
  "max_cost_per_request": 0.10
}

Chat Example

bash
curl -X POST https://api.open4x.com/v1/apps/ai/default/chat \
  -H "X-API-Key: sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [
      { "role": "user", "content": "Summarize this text in three bullets." }
    ],
    "max_tokens": 1000,
    "max_cost": 0.05
  }'

The response body follows the upstream OpenAI-compatible format. Billing metadata is returned in headers:

http
X-OpenEdge-Estimated-Cost: 0.0005
X-OpenEdge-Final-Cost: 0.0005
X-OpenEdge-Total-Tokens: 400

Streaming

bash
curl -N -X POST https://api.open4x.com/v1/apps/ai/default/chat/stream \
  -H "X-API-Key: sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [{ "role": "user", "content": "Write a short release note." }],
    "stream": true
  }'

OpenEdge forwards Server-Sent Events from the provider and settles usage when the stream completes. If the upstream provider does not return usage, settlement falls back to the pre-authorized estimate.

Embeddings

bash
curl -X POST https://api.open4x.com/v1/apps/ai/default/embeddings \
  -H "X-API-Key: sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "text-embedding-3-small",
    "input": ["first document", "second document"],
    "max_cost": 0.02
  }'

Billing

BYOK billing charges for gateway usage:

text
final_cost = request_fee + total_tokens / 1,000,000 * token_gateway_fee

The gateway checks balance before the call, records estimated and final cost, and refunds over-reserved balance when final usage is lower than the estimate.

Security

  • Provider API keys are encrypted with CONFIG_ENCRYPTION_KEY.
  • The console never returns raw provider keys.
  • base_url must be HTTPS and must pass SSRF protection.
  • Request logs store provider, model, token usage, status, cost, and latency by default, not prompts or full model responses.