Only from your real app
Every request is signed by your app on a real Apple device, so a copied token or request is useless.
Protect your AI providers
inside iOS apps.
- Secure your AI providers keys
- Usage, cost, and limits per user or install
- Add another app in minutes
Secure your app with App AI Gateway.
Never put provider API keys in your iOS app. Anyone can extract them.
Keep them in App AI Gateway. Encrypted, and never shown again.
Only signed-in users
Verified with your identity provider.
- Firebase
- Supabase
- Auth0
- Clerk
- Apple
- Custom
Only active subscribers
Free users never reach the paid model.
- RevenueCat
- Custom claim
Control AI usage.
Control your budget
Set a monthly budget per install or user, and per app.
Rate limits
Set request limits per install, per minute and per day.
Stop abuse
Block users who abuse AI usage with one click.
Performance
Hosted on Cloudflare
Scales automatically, worldwide.
- Cloudflare Workers
Streaming support
Replies stream to the device token by token.
Observability
Cost per AI provider
See what you spend on each provider, day by day.
Cost per model
Cost, tokens and requests for every model.
Cost per user
Cost and requests for every user and every install.
Easy to use
A Swift client included
Configure it once. It handles App Attest, signs every request, keeps its token fresh, and sends again once if the token expired. You send a normal URLRequest with any HTTP client.
Gateway.swiftSwift
let gateway = AppAIGatewayClient(
appID: "my-app",
baseURL: URL(string: "https://api.appaigateway.com")!,
authMode: .appAttestInstall
)
let (data, response) = try await gateway.withAuthorizedRequest(
provider: .openai,
providerPath: "v1/responses",
body: body,
contentType: "application/json"
) { try await URLSession.shared.data(for: $0) }Requests stay the same
Same paths, same bodies, same responses as the provider. Only the host changes, and the Swift client adds the authorization.
Provider request
# Before
POST https://api.openai.com/v1/responses
# After
POST https://api.appaigateway.com/v1/apps/my-app/proxy/openai/v1/responses
# Same path, same body, same response.Run the example iPhone app
See chat, images and voice notes go through the gateway in our open-source demo app.
Read the setup guide or give your agent these instructions. It sets everything up, with no account to create first.
Read https://docs.appaigateway.com/demo-ios-app.md and run the App AI Gateway demo app on my iPhone.
Flexibility
Change models without a release
Switch the model in the console. The app you shipped keeps working, no App Store review.
Provider and model fallbacks
If a provider is down, the request goes to the next model on your list.
Custom endpoints
Give a feature a name, like summarize. Pick its provider, model and settings in the console.
Supported providers and gateways
- OpenAI
- Anthropic
- Google Gemini
- xAI (Grok)
- Perplexity
- DeepSeek
- Moonshot (Kimi)
- Groq
- Mistral
- Together AI
- Fireworks AI
- Cerebras
- Hugging Face
- Baseten
- BytePlus ModelArk
- OpenRouter
- Cloudflare AI Gateway
- Vercel AI Gateway
- Any OpenAI-compatible API
All your apps in one console.
We also support server applications. Add one with an API key and it gets the same features: usage and cost, rate limits, budgets, and blocking.
How your provider keys are stored
Encrypted and stored in a protected KMS
When you add a provider key, it is encrypted and stored in a KMS in a separate Cloudflare account. No CI pipeline and no agent has access to that account, so the stored provider keys cannot be read out.
Open source
All the code is on GitHub under Apache 2.0, so it can be audited. Nothing about how keys are handled is hidden.
Audit the sourceBuilt for agents
Ask your agent to set up the gateway for you, the same way you would in the console. It can use the API, the CLI or the MCP server.
Give your agent these instructions. It can start using the gateway right away, before you even have an account.
Read https://docs.appaigateway.com/agents.md and set up App AI Gateway for my app.
Pricing
Free
$0per month
1,000 requests / month
- Up to 10 apps
- Up to 20 providers
- Up to 10 provider gateways
- Up to 5 active API keys per app
No card, no expiry
Starter
$10per month
10,000 requests / month
- Unlimited apps and end users
- Unlimited providers
- Unlimited provider gateways
- Unlimited API keys per app
- Human support
Cancel anytime
Growth
$39per month
100,000 requests / month
- Unlimited apps and end users
- Unlimited providers
- Unlimited provider gateways
- Unlimited API keys per app
- Human support
Cancel anytime
Scale
$149per month
1,000,000 requests / month
- Unlimited apps and end users
- Unlimited providers
- Unlimited provider gateways
- Unlimited API keys per app
- Human support
Cancel anytime
You bring your own provider API keys and pay the providers directly. We do not sell or resell AI model access, tokens, or credits.
You can also self-host it. The same code, Apache 2.0, in your own Cloudflare account. You pay Cloudflare and your providers, nothing to us. Deploy to Cloudflare →
Questions worth asking first.
Can I use it for free?
Yes, two ways. The hosted service has a free plan with 1,000 requests a month, no card and no expiry. Or you can self-host it: the code is open source under the Apache 2.0 license, and you pay only Cloudflare and your model providers.
What am I paying for?
On the hosted service, a flat monthly price for a request allowance. It covers the gateway itself: key storage, authentication, limits and usage. It is never a markup on tokens, because the provider keys and the provider bills are yours. Self-hosted, there is nothing to pay us. You pay Cloudflare for the Worker, database and Durable Objects, plus your model providers.
What counts against a hosted plan's monthly allowance?
Only requests actually sent to a provider. Anything the gateway refuses on its own, such as a blocked user, an exhausted per-user limit or a disallowed model, costs nothing. The console warns once 80% of the allowance is used, and an exhausted allowance answers 429 with the exact time the next monthly allowance begins.
What happens when the free allowance runs out?
Requests get a 429 with the reset time until your next monthly allowance begins. Nothing else changes: your apps, keys and settings stay as they are. Upgrade to a paid plan whenever you want more.
Can I move between hosted and self-hosted later?
Yes. It is the same code either way, so you can take your configuration to your own Cloudflare account, or the other way round.
How is this different from calling the provider directly from the app?
A key inside an iOS app can be extracted. The gateway keeps the key on the server and only issues short-lived tokens to installs that pass Apple App Attest. Every request is also signed on the device, so even a copied token can't be used. Read How to protect your OpenAI API key in an iOS app.
How does it compare with other ways to add AI to an app?
Other mobile AI gateways, provider-managed access such as Firebase AI Logic, backend platforms and your own server each give you a different mix of security, limits and price. See the comparison of AI gateways for mobile apps.
Where do the provider keys live?
Encrypted, in a KMS in a separate Cloudflare account that no CI pipeline or agent can reach. A key is never shown again after you add it. Self-hosted, the encryption key is one you generate and keep.
Do I have to use a specific model SDK?
No. Requests and responses keep the provider's own format, and streaming is passed straight through. You change the host, and the Swift client adds the authorization.
How does it know who a user is?
Through your identity provider: Firebase, Supabase, Auth0, Clerk, Sign in with Apple, or any custom issuer. The gateway verifies the token, and any claims you require, before it proxies anything. Without sign-in, each install of your app counts as one user.
Can I use it from a server rather than an iOS app?
Yes. A server app authenticates with an API key and can pass a user id, so per-user limits and usage attribution still work.
Protect your AI provider keys.
Try the hosted service, or self-host it in your own Cloudflare account.