Skip to main content
The HTTP gateway has landed on main but is not part of a published release. To run it today you build it from source or from the Dockerfile in the repository root. Flags, endpoints, and the error envelope may still change before it ships.
The gateway is the same routing core behind an HTTP surface. Point any OpenAI SDK’s base URL at it and your application code does not change — only the model string gains a provider/ prefix.

Run it

Docker or cargo, in one command.

Configure it

Four flags, and the environment it reads.

Connect a client

Python, Node, and curl against a running gateway.

HTTP API

The endpoints, with an interactive playground.

​
When to run it rather than embed the SDK

Reach for the gateway

  • You have code on the OpenAI SDK you would rather not touch
  • Several services should share one set of provider keys
  • A language with no warpllm binding needs routing
  • You want provider keys held in one place instead of every service

Reach for the SDK

  • You are writing Python, Node, or Rust and can change the client
  • You want no extra network hop
  • You would rather not operate another service

​
Endpoints

That is the whole surface today. There is no /v1/models endpoint — the roster is compiled in, and the model roster page is generated from it.

​
How a request flows

1

The gateway parses the body

A body it cannot parse is answered with an OpenAI-shaped 400 rather than the web framework’s own rejection format.
2

stream picks the reply's shape

stream: true becomes server-sent events; anything else becomes one status and one JSON body. The two shapes share nothing past this point.
3

The routing core does its work

Same roster, same key resolution, same normalization as the SDK. See Model routing.
4

Failures come back in OpenAI's envelope

So an official SDK raises its own typed exception, plus extra fields only an HTTP caller sees. See the gateway envelope.

​
Authentication

The gateway authenticates upstream with its own provider keys, read from its environment. The caller’s Authorization header is ignored and never forwarded — providers each have their own auth methods, so per-caller passthrough is ruled out by design.It ships no caller authentication of its own. Bind it to a private interface or put it behind your own auth layer. Do not expose it to a network you do not control.

​
What it logs

The model name and whether the request streamed. Never headers, never bodies — they carry credentials and prompts.

​
Next

Run the gateway

Docker, cargo, and a first request.