One gateway for your APIs, your AI traffic and your agents
An API gateway with rate limits, OpenID Connect, LDAP and JWT, traffic rules and an audit record of every change. The same gateway serves your APIs to AI agents as tools and routes LLM traffic to the providers you choose. All of it runs in your own infrastructure.
- OpenShift · Kubernetes · Docker · virtual machines
- Runs in networks without internet access
- Support in Turkish and English, included in the license
- Rate limiting
- OpenID Connect, JWT, LDAP
- Traffic Explorer and Analytics
- Canary and circuit breaker
- Audit log
- OpenAPI to MCP
What changes when nothing runs outside the gateway
Identity and access spread across systems
Every API checks its callers in its own way, and access to gateway configuration is granted case by case.
Authentication runs at the gateway with OpenID Connect, LDAP, SAML, JWTs or API keys. In the console, each person gets a role per Environment, and a role granted for Staging gives no access to Production.
Changes without a record
Configuration changes leave no trace of who made them or what they changed.
Every change through G8 passes a role check and is recorded with its values before and after. The G8 engine checks each configuration change. If it refuses one, nothing is applied.
Gateways and configuration in many places
Teams run separate gateways, each configured its own way, and no one sees all of them.
G8 manages the gateway clusters of every Environment from one console, with the same Routes, Plugins and roles. Before a Route moves from Staging to Production, G8 shows what the copy will change.
AI traffic without control
Applications call LLM providers directly, each with its own keys, limits and logs.
Send AI traffic through the gateway: provider keys stay in G8, and token limits, prompt rules and request records apply as they do to any API.
Limits, identity, logs and traffic rules for every API
G8 API Gateway runs every Plugin of the G8 engine and manages them from the G8 console. Attach them to a Route, a Service or a Consumer, or apply them across the gateway.
Limit what each client can send
Limit requests, request rates and concurrent connections by client, Consumer or a key you choose.
- Per Route or across the gatewayAttach a limit to a Route, a Service or a Consumer, or apply it to every request.
- Limits from the requestSet the count and the window as numbers, or read them from each request, such as from a header.
- Settings in the formCount, Time window, Key type, Key, Policy, Window type and Rejected code.
Check who calls your APIs
Verify callers with OpenID Connect, LDAP, SAML, Keycloak, JWTs, API keys or signed requests, and accept more than one method on the same Route.
- Your identity providerG8 connects to the identity systems you already run.
- Secrets masked by roleA client secret is shown only to roles that manage the object it belongs to.
- Settings in the formDiscovery, Client ID, Client secret, Bearer only and Unauth action.
See every request, and what changed around it
Traffic Explorer shows the gateway’s own request records. Analytics shows request counts and response times beside the changes made in the same window. Alerts tells your team when a rule or a gateway node needs attention.
- Your data storesRecords stay in your Elasticsearch or OpenSearch, counts in your Prometheus.
- Changes beside the countsAnalytics lists the changes made in the selected window, with the actor of each.
- AlertsRules you set and system alerts, such as a gateway node that stops reporting.
Change requests and responses in flight
Rewrite requests and responses on their way through the gateway, including gRPC transcoding.
- Headers and HostSet the Host sent to the upstream, and add, set or remove request headers.
- Three header listsHeaders to append, headers to write over and headers to drop.
- Settings in the formURI, Regex URI, Host, Method and Headers.
Answer repeated requests from the gateway
Cache responses at the gateway.
- Settings in the formCache strategy, Cache zone, Cache key, Cached request methods, Cached response statuses and more.
- Memory or diskA zone the gateway declares for the strategy: memory_cache or disk_cache_one, as shipped.
- Keyed on the requestHost and URI by default, or the parts of the request you choose.
Release backends gradually
Split traffic between upstream versions for canary releases, and stop sending requests to a failing backend.
- Canary splitsSplit traffic between upstream versions by weight and match rules.
- Circuit breakerWhile the breaker is open, clients get the response you set and the upstream isn’t asked.
- Settings in the formBreak response code, Unhealthy and Healthy HTTP statuses and Break response body.
Refuse malformed requests at the gateway
Check requests against a JSON schema or against your OpenAPI document before they reach the backend.
- Settings in the formDocument URL, Rejection status code and Skip body, header, query or path parameter validation.
- Only what the document allowsA request the document does not describe is refused, naming the parameter or property that failed if you choose.
- The status you chooseA refused request is answered with the code you set.
What API Gateway works with
Identity
- OpenID Connect
- LDAP
- SAML
- Keycloak
- JWT
- API keys
- Signed requestsHMAC
- Basic authentication
- Open Policy Agent
- Forward authentication
Accept more than one method on the same Route.
Logs and telemetry
- HTTP endpointslogs
- Kafkalogs
- Elasticsearchlogs
- sysloglogs
- Prometheusmetrics
- Zipkintraces
Logs go to the systems you already run.
Traffic
- Request count limits
- Request rate limits
- Connection limits
- Canary splits
- Circuit breaker
- Response cache
Per Route, per Service, per Consumer or across the gateway.
In the console
- Analytics
- Traffic Explorer
- Alerts
- Gateway nodes
- Audit log
Read from your own Prometheus and Elasticsearch or OpenSearch.
AI traffic under the same rules as your APIs
G8 AI Gateway serves your existing APIs to AI agents and sends requests to the LLM providers you choose. Token limits, prompt rules and caching sit on the same Routes, with the same roles, audit and Environments as your APIs.
Serve your existing APIs to AI agents, with the rules they already have
Add the openapi-to-mcp Plugin to a Route and point it at an API’s OpenAPI document. MCP clients, such as AI agents, can then call the API’s operations as tools. The G8 engine does the conversion, inside your infrastructure.
Your identity
The Route’s authentication applies to tool calls: MCP clients sign in like any other client.
Your limits
Rate limits on the Route count tool calls as requests.
Your logs
Tool calls appear in Traffic Explorer and in the logs you already send.
Send each request to the right provider
Route traffic to OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Google Gemini, Vertex AI, DeepSeek, OpenRouter or any OpenAI-compatible endpoint, and fall back to another provider when one returns a server error or is rate limited.
- One Route, many providersApplications call one Route. The provider and its key are set in the Plugin, masked for roles that can’t manage it.
- InstancesA primary and a fallback provider, each with its own key.
- FallbackMove a request to the next instance when one fails or is rate limited.
Budget tokens, not just requests
Limit the tokens that traffic to a model can use in a time window.
- Per Route, provider or keyOne budget for the Route or for each provider instance, or a budget for each key.
- Settings in the formLimit, Time window, Rules, Instances, Limit strategy, Policy and Rejected code.
- On each node or sharedCount on each gateway node, or share the count across nodes in Redis.
Your rules around every prompt
Allow or refuse prompts by patterns you define, build prompts from your own templates and add your instructions before or after the user’s prompt.
- Prompt guardRefuse prompts that match a deny pattern, or let through only those that match an allow pattern.
- What is checkedOnly the user’s messages, or every role and the whole conversation history.
- DecoratorsPut your messages before or after the client’s, such as a system instruction.
Answer repeated prompts from a cache
Answer a prompt from the cache when it matches an earlier one exactly or by meaning, instead of sending it to the model again.
- Settings in the formLayers, Exact layer, Policy, Semantic layer, Cache key and Bypass rules.
- Needs RedisThe cache is kept in Redis. The semantic layer also needs the RediSearch module.
- Semantic layerAn embedding model and a vector index decide when two prompts mean the same thing.
Add your documents to the prompt
Add documents retrieved from a vector search to the prompt before it reaches the model. Connects to an external service.
- EmbeddingsThe request’s question is embedded with Azure OpenAI.
- Keys maskedBoth keys are stored on the engine and shown only to roles that manage the object.
- Azure AI SearchThe vector search runs in Azure AI Search; what it returns is added to the prompt.
Check content before it reaches a model
Send request content to a moderation service before the model sees it. Connects to an external service.
- Amazon ComprehendScores toxicity overall and by category, such as hate speech, insult or violence.
- Request, response or bothCheck what the client sends, what the model answers, or both.
- The code you chooseA refused request is answered with the status you set.
Screen prompts with Lakera Guard
Check prompts with Lakera Guard before they reach the model. Connects to an external service.
- Your Lakera projectThe project you name decides which detectors and thresholds apply.
- Settings in the formAPI key, Project ID, Direction, Action, Deny code and Fail open.
- When Lakera can’t be reachedChoose whether requests go through or are denied.
API Security and Developer Portal
Security that runs at the gateway and in the console
Authentication, access rules, request validation and data masking run on your Routes. Certificates and secrets are managed in G8. The console adds roles per Environment and an audit record of every change.
A catalog for the developers who use your APIs
A catalog of your APIs, with documentation and self-service access for the developers who use them. Included in the G8 license.
- API catalog
- Documentation
- Self-service access
Environments, roles and audit, across all four areas
Environments, access rules and the audit log are one layer of G8, and it applies to all four areas: API Gateway, AI Gateway, API Security and Developer Portal.
Development, Staging and Production in the same console
A G8 installation manages separate gateway clusters, each as its own Environment. Add a cluster you already run: adding or removing an Environment doesn’t touch the G8 engine.
Before you copy a Route, Service or Upstream to another Environment, G8 shows what the copy will change there. Nothing is written to the target until you save. In a protected Environment, deleting an object requires typing its name.
Who can change what, and how G8 records it
Roles per Environment
Give each person a role in a specific Environment, or in all of them. A role granted for Staging gives no access to Production. Use the built-in roles (Platform administrator, Environment administrator, Editor, Viewer) or build your own from a permission grid.
Roles that can’t manage a resource see its secret fields masked. Service accounts with expiring tokens handle automation.
Recorded before it’s applied
When someone changes gateway configuration through G8, the change passes a role check, and an audit record is opened before it’s applied. If the audit record can’t be written, the change isn’t applied. The G8 engine checks each configuration change. If it refuses one, nothing is applied. Change attempts that a role doesn’t allow are recorded too.
For a gateway change, the record keeps the values before and after the change, with secret fields masked.
Every part of G8 runs in your infrastructure
Every part of G8, including its console, runs in your infrastructure. It installs on OpenShift, Kubernetes, Docker or virtual machines.
The console and management API sit beside the traffic path. API traffic doesn’t pass through them. G8 scales horizontally: run it as multiple replicas that share one database.
Guides and articles from the G8 team
What the conversion does, where it runs and which rules of the Route still apply.
The pieces you provide, how G8 sits beside the traffic path and what to prepare.
How a change is checked and recorded, why one is refused and what the record keeps.
See your APIs and your AI traffic behind one gateway
Our team walks you through G8 with traffic like yours: how access and audit work, and where it fits in your infrastructure.
- 01Demo
- 02Proof of conceptOn Docker for a quick start, or on the infrastructure you plan to run G8 on.
- 03LicenseWe prepare a quote for your edition and nodes, and you receive a signed license file.
One gateway for your APIs, your AI traffic and your agents
An API gateway with rate limits, OpenID Connect, LDAP and JWT, traffic rules and an audit record of every change. The same gateway serves your APIs to AI agents as tools and routes LLM traffic to the providers you choose. All of it runs in your own infrastructure.
- Rate limiting
- OpenID Connect, JWT, LDAP
- Traffic Explorer and Analytics
- Canary and circuit breaker
- Audit log
- OpenAPI to MCP
- A Route to language modelsAI traffic runs on the same Routes, roles, Environments and audit record as your APIs.
- OpenAPI to MCPMCP clients, such as AI agents, can then call the API’s operations as tools.
- OpenShift · KubernetesDocker · virtual machines
- Runs in networks without internet access
- Support in Turkish and English, included in the license
What changes when nothing runs outside the gateway
Identity and access spread across systems
With G8Authentication runs at the gateway, and each person gets a role per Environment.
How API Security worksChanges without a record
With G8Every change passes a role check and is recorded with its values before and after.
How the audit log worksGateways and configuration in many places
With G8G8 manages the gateway clusters of every Environment from one console, with the same Routes, Plugins and roles.
How Environments workAI traffic without control
With G8Provider keys stay in G8, and token limits, prompt rules and request records apply as they do to any API.
What AI Gateway covers
Limits, identity, logs and traffic rules for every API
G8 API Gateway runs every Plugin of the G8 engine and manages them from the G8 console.
Explore API GatewayLimit requests, request rates and concurrent connections by client, Consumer or a key you choose.
Verify callers with OpenID Connect, LDAP, SAML, Keycloak, JWTs, API keys or signed requests, and accept more than one method on the same Route.
Traffic Explorer shows the gateway’s own request records. Analytics shows request counts beside the changes made in the same window. Alerts tells your team when a rule or a gateway node needs attention.
Records stay in your Elasticsearch or OpenSearch, counts in your Prometheus.
Observability in API GatewayRewrite requests and responses on their way through the gateway, including gRPC transcoding.
Split traffic between upstream versions for canary releases, and stop sending requests to a failing backend.
Check requests against a JSON schema or against your OpenAPI document before they reach the backend.
AI traffic under the same rules as your APIs
G8 AI Gateway serves your existing APIs to AI agents and sends requests to the LLM providers you choose.
Explore AI GatewayServe your existing APIs to AI agents, with the rules they already have
Add the openapi-to-mcp Plugin to a Route and point it at an API’s OpenAPI document. MCP clients, such as AI agents, can then call the API’s operations as tools.
- Your identityMCP clients sign in like any other client.
- Your limitsRate limits count tool calls as requests.
- Your logsTool calls appear in Traffic Explorer and in the logs you already send.
Send each request to the provider you choose, and fall back to another one when a provider returns a server error or is rate limited. Provider keys stay in the Plugin, masked for roles that can’t manage it.
Limit the tokens that traffic to a model can use in a time window.
Allow or refuse prompts by patterns you define, build prompts from your own templates and add your instructions before or after the user’s prompt.
Answer a prompt from the cache when it matches an earlier one exactly or by meaning, instead of sending it to the model again.
Add documents retrieved from a vector search to the prompt before it reaches the model.
Send request content to a moderation service before the model sees it.
Check prompts with Lakera Guard before they reach the model.
API Security and Developer Portal
API SecuritySecurity that runs at the gateway and in the console
Authentication, access rules, request validation and data masking run on your Routes. Certificates and secrets are managed in G8.
A catalog for the developers who use your APIs
Documentation and self-service access for the developers who use your APIs. Included in the G8 license.
- API catalog
- Documentation
- Self-service access
Environments, roles and audit, across all four areas
Environments, access rules and the audit log are one layer of G8, and it applies to all four areas.
Development, Staging and Production in the same console
Each gateway cluster is its own Environment. Before you copy a Route, Service or Upstream to another Environment, G8 shows what the copy will change there.
- SecretsCopied only while “Copy secrets too” is selected.
- Missing dependenciesObjects the copy refers to that don’t exist in the target yet.
- What will changeIf the object already exists in the target, the copy replaces it, and the lines it adds and removes are listed.
Who can change what, and how G8 records it
Roles per Environment
Give each person a role in a specific Environment, or in all of them. A role granted for Staging gives no access to Production. Use the built-in roles or build your own from a permission grid.
Recorded before it’s applied
A change through G8 passes a role check, and an audit record is opened before it’s applied. If the record can’t be written, or the G8 engine refuses the change, nothing is applied.
Every part of G8 runs in your infrastructure
The console and management API sit beside the traffic path. API traffic doesn’t pass through them.
Guides and articles from the G8 team
See your APIs and your AI traffic behind one gateway
Our team walks you through G8 with traffic like yours: how access and audit work, and where it fits in your infrastructure.
- 01Demo
- 02Proof of conceptOn Docker for a quick start, or on the infrastructure you plan to run G8 on.
- 03LicenseWe prepare a quote for your edition and nodes, and you receive a signed license file.