Inference gateways

A gateway is an OpenAI-compatible base URL plus an encrypted API key. Select a gateway model in chat and the turn streams through that endpoint.

Where it lives

Settings → AI manages gateway configs for the workspace. The API key is stored encrypted in the vault lane and is never returned to the browser — only a boolean that a key is configured.

Selecting a gateway:<id> model routes that turn through the backend's gateway branch, which streams the external SSE response through to the client.

Safety

• Base URLs pass the shared outbound URL guard (SSRF).
• Privileged columns are not writable through the generic database API.
• The generic select path never returns more than the dedicated route (no cipher material).

Self-hosters must keep the same secrets encryption key on every host that reads vault rows — see Self-hosting.