Create an application

Open Apps and click New app. The wizard asks only what it needs for the type of app you pick, and everything it sets can be changed later on the app's own pages.

1. Basics

• Application name: how the app is listed. The gateway builds the app's permanent ID from it, for example Calorie Tracker becomes calorie-tracker-k3f9x1. See Apps and providers.
• Application type:
  • iOS application: calls AI providers straight from the app. The app proves itself with Apple App Attest.
  • Server: a backend you run, using a private API key.

2. Application identity (iOS only)

Only builds signed with your team and bundle ID can call the gateway through this app.

• Apple Team ID: in your Apple Developer account under Membership details.
• Bundle ID: in Xcode, on your target's Signing & Capabilities tab.
• iOS app environment: Production covers TestFlight and App Store builds. Development covers builds run from Xcode. Keep Development on a development bundle ID rather than the one you ship. See Application identity.

3. User authentication

Whether requests are tied to a user, and how the gateway knows who that is.

For an iOS app:

• Signed-in users only: users sign in through your identity provider, and the gateway verifies it.
• Unauthenticated users: anyone with your app can call. Each installation counts as one user.

For a server:

• Signed-in users only: your backend forwards each user's sign-in token, and the gateway verifies it.
• Your backend sends the user id: in the x-end-user-id header on every request.
• No user identity: requests are not linked to any user.

If you do not have your identity provider's details yet, the step offers to continue without them so you can set this up later.

4. Identity provider (signed-in users only)

Pick where your users sign in. The preset fills in the verification settings from one or two values you already have.

Each preset has a note about what its provider needs. See User authentication.

5. Subscription check (signed-in users only)

Whether the user must have paid before they can call AI providers through this app.

• No entitlement check: any user the issuer signs a token for may call.
• RevenueCat entitlement: enter the entitlement identifier, for example pro.
• Custom claim: enter the claim path and the required value.

See Subscription check.

What is created

Click Create app. The new app allows every provider you have, has no model rewrites and no named endpoints, and is active.

• An iOS application starts with per-user limits of 10 requests per minute and 300 per day, and no spending budget.
• A server application starts with no limits at all.

A server application also gets its first API key, shown once in a dialog titled Your application is ready, together with the base URL your backend will call. Copy the key before closing the dialog. More keys can be created later on the app's Auth policy page.

Then you land on Proxy policy, where you can narrow which providers, paths and models the app may use. New apps allow everything, so that step is optional.

Through the API

POST /v1/admin/apps creates the same thing. The body carries name, config and an optional status, never an id. The response returns the app with its assigned app.id, and api_key.key for a server application.

A server app with no user identity:

{
  "name": "Search service",
  "config": {
    "authentication": { "type": "api_key" },
    "routing": { "providers": { "mode": "all" }, "model_rewrites": {} }
  }
}

An iOS app with signed-in users from Firebase and the default limits:

{
  "name": "Calorie Tracker",
  "config": {
    "authentication": {
      "type": "apple_app_attest",
      "app_attest": { "team_id": "ABCDE12345", "bundle_id": "com.example.calorietracker" },
      "end_user": {
        "source": "issuer",
        "issuer": {
          "jwks_url": "https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com",
          "issuer": "https://securetoken.google.com/my-app-1a2b3",
          "audience": "my-app-1a2b3",
          "user_id_claim": "sub",
          "required_claims": [],
          "max_token_lifetime_seconds": 86400,
          "provider": "firebase"
        }
      }
    },
    "routing": { "providers": { "mode": "all" }, "model_rewrites": {} },
    "limits": {
      "per_user": { "requests": { "per_minute": 10, "per_day": 300 }, "spending": { "monthly_usd": null } },
      "per_app": { "requests": { "per_minute": null, "per_day": null }, "spending": { "monthly_usd": null } }
    }
  }
}

Every key is described in the application configuration reference.