One endpoint. Every model. Zero key chaos.
Open-source enterprise AI gateway. Pool and load-balance API keys across Anthropic, OpenAI, Google, and Groq behind one OpenAI-compatible endpoint — with atomic admission control, circuit breaking, cost-aware routing, and team budgets.
Recent Activity
Production-hardened from day one.
Key Pool Management
Pool unlimited provider keys with AES-256-GCM encryption. Zero plaintext at rest.
Tiered Failover
Exhausted keys rotate to the next eligible key — 503 only when the entire chain is dry.
Circuit Breaker
Escalating cooldown (10s → 20s → 40s, capped at 10 min) with half-open recovery probing.
Cost-Aware Routing
Routes to the cheapest capable provider after breaker, headroom, and cache-affinity checks.
Cache-Aware Sticky Routing
Multi-turn conversations stay pinned to the same provider — prompt cache hits, not misses.
Response Caching
Exact-match Redis cache on model + messages + params. Cache hits replayed as streams.
Content Guardrails
Pluggable input-side prompt filtering. Bring your own ruleset — off by default.
Prometheus + OpenTelemetry
Scrapeable /metrics: request rate, TTFT, cache-hit rate, breaker state, pool utilisation.
Team Budgets
Per-period spend caps enforced atomically in the same Redis Lua script as RPM/TPM admission.
SSRF Protection
Upstream URL allowlist prevents server-side request forgery on every outbound call.
Real Token Counting
js-tiktoken tokenizer for accurate pre-admission estimates — not text.length ÷ 4.
Async Analytics Pipeline
Usage events buffered in-process and flushed in batches. No INSERT per request on the hot path.
Every major model provider. One endpoint.
Full visibility into your gateway.
Key Pool Overview
Screenshot coming soon
Analytics & Usage
Screenshot coming soon
Team Budget Tracker
Screenshot coming soon
Deploy in under five minutes.
# Pull and run Alayra Nexus docker run -d \ --name alayra-nexus \ -p 3210:3210 \ -e DATABASE_URL="postgresql://user:pass@host:5432/nexus" \ -e REDIS_URL="redis://localhost:6379" \ -e NEXUS_MASTER_KEY="your-32-byte-encryption-key" \ alayrasystems/nexus:latest
What ships next.
BYOK
Teams register personal provider keys, encrypted, routed only for that team — with shared-pool fallback.
2FA / TOTP
QR-based TOTP enrollment for admin accounts. Constant-time comparison on all secret checks.
RBAC Roles
Superadmin, Admin, Team Admin, and Viewer hierarchy with per-route role guards.
SSO & SAML 2.0
Enterprise identity provider login mapping external groups to RBAC roles.
Prompt Caching
Provider-level prompt cache awareness — reduce cost on repeated context across multi-turn sessions.
Audit & Compliance Log
Immutable admin action trail with GDPR-friendly retention windows and field-level redaction.
Custom Domains
CNAME-based white-labeling — route your own domain to a team-scoped Nexus endpoint.
Alerts & Webhooks
Rule-based usage alerts on budget, latency, and error thresholds with email and webhook delivery.
Benchmark Suite
Published k6 load test with real p50/p99 numbers on defined hardware — claims backed by data.
Self-hosted. Open source. No lock-in.
Deploy on your own infrastructure in minutes. Apache 2.0 — fork it, ship it, own it.