AI Gateway
One endpoint in front of every model and every tool your team uses.
Point your applications, notebooks and coding agents at a single address. The gateway routes each call to the right provider, holds the credentials so your clients never do, enforces who may reach what, and counts every request.
It runs inside your own cloud account, in the same project as your clusters.
What it gives you
| One address | Clients call the gateway, never a provider directly. |
| One credential | A short-lived token per person or agent. No provider keys handed out. |
| One allowlist | Nothing is reachable until you grant it. |
| One record | Every call metered and attributed to whoever made it. |
What you can put behind it
- Models — from Anthropic, OpenAI, AWS Bedrock and Baseten, published under stable names your clients call. Bedrock is available on AWS projects.
- Tools — MCP servers you register. MCP (Model Context Protocol) is the standard way an agent discovers and calls tools. On AWS projects, the Onehouse MCP server is already registered, so agents can read and manage your Onehouse project.
Your network, your keys
The gateway's endpoint is reachable only from inside your network — it is never public. Provider credentials can stay in your own secret store; the gateway reads them by reference and copies nothing.
Where it lives in the console
| What | Where |
|---|---|
| Turning the gateway on, its address, tool servers, and usage | AI Gateway, the first item under Serve — tabs Overview, MCP Servers and Usage |
| Providers and the models you publish | Models & Providers, under Clusters — tabs Models and Providers |
| Identity for your data plane | Account Settings → Identity — tabs Dataplane IDP and OIDC |
| Your own token, and setup for your client | The oh CLI: oh ai-gateway login. Or the gateway's own token page — open it with Get my token on the Overview |
Where to go next
| If you are | Start at |
|---|---|
| Setting this up for your team | Quickstart, then Set up the gateway |
| Wanting to use it from Claude Code, Codex or another client | Connect your client |
| Setting up an agent | Agent access |
| Checking a limit, or what each cloud supports | Limits |
| Seeing a call refused | Troubleshooting |