Enterprise LLM gateway: One key. Control every call.

Built in Rust, the gateway checks your virtual key permissions and model access rules, enforces key and organization rate limits, and evaluates your configured input guardrails before reserving credits and calling the upstream model provider. You can inspect which checks ran on each call in dashboard Logs and response headers.

When access checks, rate limits, or your configured input guardrails reject a request before credit reservation, the gateway returns an error (such as HTTP 400 with x-nr-guardrails: blocked on an input policy block, HTTP 401 or 403 on access refusals, or HTTP 429 on rate limits) with $0 held and $0 spent. Preflight can also take and immediately release a reservation if a later pre-call step refuses the call. By contrast, if an output guardrail blocks or withholds a response after the provider has generated tokens, those consumed tokens still settle at the served model list price.

The gateway runs built-in baseline protections alongside the input and output rules you configure for your organization, team, or virtual key, plus any per-request nrouter_guardrails additions. Because coverage depends on your active policy and request content, every response reports the actual inspection outcome in x-nr-guardrails: pass, redacted, blocked, monitor (when only warn or log rules apply), partial (when attachments or unscannable content were not inspected by text detectors), none (when no policy evaluated), or unavailable.

Before calling a provider, the gateway places a single credit reservation sized to cover your request and any configured fallback models. If the primary attempt fails before delivering a response—such as on an upstream 429, 503, 529, connection fault, or first-byte timeout—the gateway advances to your next configured fallback under that same reservation. Once a model answers, the request settles once at the published list price of the model that served the response and releases any unused reservation.

For buffered responses, the gateway calculates the charge when the provider response finishes and returns x-nr-request-cost with x-nr-cost-status: exact. For streaming responses, HTTP headers are sent before generation completes, so initial headers cannot contain the final cost; the dashboard shows Pending while tokens stream and resolves the settled charge from your request log once the stream closes. If a response cannot be priced from the catalogue, x-nr-cost-status reports unpriced and omits x-nr-request-cost rather than reporting a false $0.

No. A 0% platform fee and 0% token markup is our standard pricing: completed requests settle against your organization credit balance (or an active legacy plan allowance, never split across both on one call) at the served model’s published list price. On self-serve Stripe credit purchases ($5 minimum), nRouter absorbs the standard 2.9% + $0.30 card processing fee so a $100 payment adds $100.00 to your credit balance.

Gateway request logs store operational metadata only: request ID, timestamps, served model, token counts, settled charge, latency, routing outcome, and guardrail status. Raw prompt bodies and completion text are not written to gateway request logs. To generate a response, your prompt (after any configured pre-call redaction) is transmitted to the selected upstream model provider, where that provider’s data handling terms apply.

Point your OpenAI-compatible or Anthropic-compatible client at https://api.nrouter.ai/v1 (or /v1/messages) and authenticate with an nRouter virtual key (sk-nrouter-*). Each model in the live catalogue (/models) lists the specific endpoints and modalities it supports; direct calls and fallback chains must target models compatible with the endpoint you call. Pay-as-you-go accounts start immediately with a $5 deposit, and organizations needing custom rate limits, SLAs, or procurement terms can reach our team at /contact.