A single, OpenAI- and Anthropic-compatible endpoint in front of every provider. Your keys stay central and encrypted, your fleet never holds them, and every call is governed, metered, and audited — with smart routing and load-balancing built in.
Point any OpenAI- or Anthropic-compatible client — including every Aura Workshop node in your fleet — at your gateway URL with a gateway token. Configure once; govern everywhere.
Aura Gateway is a multi-tenant, multi-modal proxy. Clients speak the standard OpenAI or Anthropic API; the gateway resolves the right provider, injects the central key, enforces your policy, balances load, and meters spend — then streams the response straight back. Chat, responses, messages, embeddings, images, voice, video, and music all flow through the same governed path.
Works with any OpenAI- or Anthropic-compatible SDK or tool. Change the base URL and key — nothing else.
Text, embeddings, images, speech, video, and music — one endpoint, one policy, one bill.
Use our hosted gateway, or run your own on-prem with the same image — your data path, your control.
Add each provider's API key once in the portal. Keys are encrypted at rest with a master key that never leaves the server, and they are never distributed to devices. Every node and app authenticates with a revocable gateway token instead — so a lost laptop never means a leaked provider key.
Keys sealed with a server-side master key. Plaintext is shown once on entry and never again.
Devices carry a scoped gateway token, not the real key. Revoke a token without touching the key.
Built-in support for the major providers — plus a custom-provider option for anything OpenAI-compatible.
Swap or rotate a key in one place; the whole fleet picks it up instantly — no redeploy.
Draft and publish a versioned policy in the portal; the gateway enforces it on every call and pushes it down to your managed fleet. Allow or block specific models, require zero-data-retention models, cap tool categories, and constrain who can do what — centrally, with a full history.
A hard ceiling on which models your org can call. Block-list always wins; allow-list caps the rest.
Flip ZDR on and only zero-retention models are permitted — enforced server-side, not on trust.
Owner, admin, auditor, billing, member — least-privilege control over keys, policy, and spend.
Single sign-on and directory-synced provisioning via your identity provider (WorkOS).
Every policy is versioned and republishable. Roll forward or back; the fleet pulls the change.
Cross-tenant staff plane for managing orgs, seats, lifecycle, and user administration.
Security isn't a setting you remember to turn on — it's the default path. Secrets are encrypted, prompts are scrubbed before they leave your perimeter, and every action is written to a tamper-evident log you can verify cryptographically.
Inbound guardrails detect and redact secrets, PII, and prompt-injection before a request reaches any provider.
Provider keys and credentials are encrypted at rest; the master key is never shipped to clients.
An append-only, hash-chained audit log of every sensitive action — verifiable for tamper-evidence.
Per-device gateway and ingest tokens you can restrict, disable, unenroll, or revoke at any time.
Zero-data-retention is enforced at the gateway — non-compliant models are refused, not merely discouraged.
Run the entire gateway inside your network so no prompt or response ever leaves your infrastructure.
The gateway meters every call and attributes cost to the user and model behind it. Set per-user daily and monthly limits that are enforced in real time, watch organization budgets, and stop runaway spend before it happens — across every provider at once.
Daily and monthly USD limits per user, enforced on the request path — not after the invoice.
Track month-to-date spend against a budget with alert thresholds before you hit the ceiling.
Every call metered with cost, tokens, latency, and routing tier — by user, model, and provider.
One spend view spanning every provider you use, instead of a dozen separate dashboards.
auto — get the right model, every time
Point a request at the model auto and the gateway scores the prompt's complexity and
weight-picks a model from the matching tier — simple, standard, complex, or reasoning. Add multiple
keys per provider to spread load by weight, and define a fallback order so a single provider outage
never stops your fleet.
Prompt complexity is scored centrally and resolved to a tier model — cheap work stays cheap.
Multiple keys per provider, each taking a share of traffic proportional to its weight.
On a provider error, the gateway fails over across the tier and your global fallback order.
Latency and rate-limit signals feed dynamic strategies so traffic favors what's healthy.
Disable a key to drain it gracefully instead of deleting — rotate providers with zero interruption.
Pin a tier with auto:standard or auto:complex when you want control.
Drop an enrollment file next to Aura Workshop (or push it via MDM) and the device self-registers as a managed node. From then on it sources its models from your gateway catalog, routes every call through the gateway, and inherits your policy, spend caps, and managed MCP servers — with those settings locked so users can't override them.
One enrollment file; devices register themselves and appear in your fleet — no per-machine setup.
Provider keys, models, routing, and guardrails are governed centrally and read-only on the device.
Push MCP servers — dependencies and skills included — to every node and keep them in sync.
Publish a policy and the fleet pulls it on its next sync — allow-lists, ZDR, caps, and more.
Cut a device's access, free its seat, or revert it to unmanaged — from the portal, instantly.
Content-free usage and cost telemetry rolls up per device, user, and model in the portal.
Add a key for any of these out of the box, or define a custom provider with its own name, base URL, and key.
Claude Opus, Sonnet, Haiku
GPT-5, GPT-4o, o-series
Gemini 2.5 Pro & Flash
DeepSeek V3, Reasoner
Long-context K2 models
Text, voice, video, music
Grok models
Ultra-low-latency inference
Open-weight model hosts
Leading providers
Aggregation & voice
Any OpenAI-compatible base URL
Enter each provider's key once in the portal. They're encrypted at rest and never leave the server.
Set allowed/blocked models, ZDR, spend caps, guardrails, and routing — versioned and republishable.
Distribute the enrollment file with Aura Workshop. Each device self-registers and gets a gateway token + URL.
Central keys, enforced policy, real spend control, and smart routing — for your whole company.