One gateway for your APIs, your AI traffic and your agents
G8 runs in your own infrastructure. Serve your existing APIs to AI agents as tools, send LLM traffic to the providers you choose, and keep the same identity, limits and audit record for all of it.
- OpenShift · Kubernetes · Docker · virtual machines
- Runs in networks without internet access
- Support in Turkish and English, included in the license
What changes when nothing runs outside the gateway
Gateways and configuration in many places
Teams run separate gateways, each configured its own way, and no one sees all of them.
G8 manages the gateway clusters of every Environment from one console, with the same Routes, Plugins and roles. Before a Route moves from Staging to Production, G8 shows what the copy will change.
AI traffic without control
Applications call LLM providers directly, each with its own keys, limits and logs.
Send AI traffic through the gateway: provider keys stay in G8, and token limits, prompt rules and request records apply as they do to any API.
Identity and access spread across systems
Every API checks its callers in its own way, and access to gateway configuration is granted case by case.
Authentication runs at the gateway with OpenID Connect, LDAP, SAML, JWTs or API keys. In the console, each person gets a role per Environment, and a role granted for Staging gives no access to Production.
Changes without a record
Configuration changes leave no trace of who made them or what they changed.
Every change through G8 passes a role check and is recorded with its values before and after. The G8 engine checks each configuration change. If it refuses one, nothing is applied.
Limits, identity, logs and traffic rules for every API
G8 API Gateway runs every Plugin of the G8 engine and manages them from the G8 console. Attach them to a Route, a Service or a Consumer, or apply them across the gateway.
Limit what each client can send
Limit requests, request rates and concurrent connections by client, Consumer or a key you choose.
- Per Route or across the gatewayAttach a limit to a Route, a Service or a Consumer, or apply it to every request.
Check who calls your APIs
Verify callers with OpenID Connect, LDAP, SAML, Keycloak, JWTs, API keys or signed requests, and accept more than one method on the same Route.
- Your identity providerG8 connects to the identity systems you already run.
See every request, and what changed around it
Traffic Explorer shows the gateway’s own request records. Analytics shows request counts and response times beside the changes made in the same window. Alerts tells your team when a rule or a gateway node needs attention.
- Your data storesRecords stay in your Elasticsearch or OpenSearch, counts in your Prometheus.
- Sensitive fields maskedHeaders such as authorization and cookie are masked by default. Viewing a request body takes its own permission and is written to the audit log.
- Logs where you need themSend access logs to HTTP endpoints, Kafka, Elasticsearch or syslog, expose metrics and export traces.
Change requests and responses in flight
Rewrite requests and responses on their way through the gateway, including gRPC transcoding.
Release backends gradually
Split traffic between upstream versions for canary releases, and stop sending requests to a failing backend.
Refuse malformed requests at the gateway
Check requests against a JSON schema or against your OpenAPI document before they reach the backend.
What API Gateway works with
Identity
- OpenID Connect
- LDAP
- SAML
- Keycloak
- JWT
- API keys
- Signed requestsHMAC
- Basic authentication
- Open Policy Agent
- Forward authentication
Accept more than one method on the same Route.
Logs and telemetry
- HTTP endpointslogs
- Kafkalogs
- Elasticsearchlogs
- sysloglogs
- Prometheusmetrics
- Zipkintraces
Logs go to the systems you already run.
Traffic
- Request count limits
- Request rate limits
- Connection limits
- Canary splits
- Circuit breaker
- Response cache
Per Route, per Service, per Consumer or across the gateway.
In the console
- Analytics
- Traffic Explorer
- Alerts
- Gateway nodes
- Audit log
Read from your own Prometheus and Elasticsearch or OpenSearch.
AI traffic under the same rules as your APIs
G8 AI Gateway serves your existing APIs to AI agents and sends requests to the LLM providers you choose. Token limits, prompt rules and caching sit on the same Routes, with the same roles, audit and Environments as your APIs.
Serve your existing APIs to AI agents, with the rules they already have
Add the openapi-to-mcp Plugin to a Route and point it at an API’s OpenAPI document. MCP clients, such as AI agents, can then call the API’s operations as tools. The G8 engine does the conversion, inside your infrastructure.
Your identity
The Route’s authentication applies to tool calls: MCP clients sign in like any other client.
Your limits
Rate limits on the Route count tool calls as requests.
Your logs
Tool calls appear in Traffic Explorer and in the logs you already send.
Send each request to the right provider
Route traffic to OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Google Gemini, Vertex AI, DeepSeek, OpenRouter or any OpenAI-compatible endpoint, and fall back to another provider when one returns a server error or is rate limited.
- Keys stay at the gatewayApplications call one Route. Provider keys are set in the Plugin, masked for roles that can’t manage it.
- Balancing and fallbackSpread requests across instances and move to the next one when an instance fails.
Budget tokens, not just requests
Limit the tokens that traffic to a model can use in a time window.
Your rules around every prompt
Allow or refuse prompts by patterns you define, build prompts from your own templates and add your instructions before or after the user’s prompt.
Answer repeated prompts from a cache
Answer a prompt from the cache when it matches an earlier one exactly or by meaning, instead of sending it to the model again.
Add your documents to the prompt
Add documents retrieved from a vector search to the prompt before it reaches the model. Connects to an external service.
Check content before it reaches a model
Send request content to a moderation service before the model sees it. Connects to an external service.
Screen prompts with Lakera Guard
Check prompts with Lakera Guard before they reach the model. Connects to an external service.
API Security and Developer Portal
Security that runs at the gateway and in the console
Authentication, access rules, request validation and data masking run on your Routes. Certificates and secrets are managed in G8. The console adds roles per Environment and an audit record of every change.
A catalog for the developers who use your APIs
A catalog of your APIs, with documentation and self-service access for the developers who use them. Included in the G8 license.
- API catalog
- Documentation
- Self-service access
Environments, roles and audit, across all four areas
Environments, access rules and the audit log are one layer of G8, and it applies to all four areas: API Gateway, AI Gateway, API Security and Developer Portal.
Development, Staging and Production in the same console
A G8 installation manages separate gateway clusters, each as its own Environment. Add a cluster you already run: adding or removing an Environment doesn’t touch the G8 engine.
Before you copy a Route, Service or Upstream to another Environment, G8 shows what the copy will change there. Nothing is written to the target until you save. In a protected Environment, deleting an object requires typing its name.
Who can change what, and how G8 records it
Roles per Environment
Give each person a role in a specific Environment, or in all of them. A role granted for Staging gives no access to Production. Use the built-in roles (Platform administrator, Environment administrator, Editor, Viewer) or build your own from a permission grid.
Roles that can’t manage a resource see its secret fields masked. Service accounts with expiring tokens handle automation.
Recorded before it’s applied
When someone changes gateway configuration through G8, the change passes a role check, and an audit record is opened before it’s applied. If the audit record can’t be written, the change isn’t applied. The G8 engine checks each configuration change. If it refuses one, nothing is applied. Change attempts that a role doesn’t allow are recorded too.
For a gateway change, the record keeps the values before and after the change, with secret fields masked.
Every part of G8 runs in your infrastructure
Every part of G8, including its console, runs in your infrastructure. It installs on OpenShift, Kubernetes, Docker or virtual machines.
The console and management API sit beside the traffic path. API traffic doesn’t pass through them. G8 scales horizontally: run it as multiple replicas that share one database.
Guides and articles from the G8 team
What the conversion does, where it runs and which rules of the Route still apply.
The pieces you provide, how G8 sits beside the traffic path and what to prepare.
How a change is checked and recorded, why one is refused and what the record keeps.
See your APIs and your AI traffic behind one gateway
Our team walks you through G8 with traffic like yours: how access and audit work, and where it fits in your infrastructure.
- 01Demo
- 02Proof of conceptOn Docker for a quick start, or on the infrastructure you plan to run G8 on.
- 03LicenseWe prepare a quote for your edition and nodes, and you receive a signed license file.
One gateway for your APIs, your AI traffic and your agents
G8 runs in your own infrastructure. Serve your existing APIs to AI agents as tools, send LLM traffic to the providers you choose, and keep the same identity, limits and audit record for all of it.
- A Route to language modelsAI traffic runs on the same Routes, roles, Environments and audit record as your APIs.
- OpenAPI to MCPMCP clients, such as AI agents, can then call the API’s operations as tools.
- OpenShift · KubernetesDocker · virtual machines
- Runs in networks without internet access
- Support in Turkish and English, included in the license
What changes when nothing runs outside the gateway
Gateways and configuration in many places
With G8G8 manages the gateway clusters of every Environment from one console, with the same Routes, Plugins and roles.
How Environments workAI traffic without control
With G8Provider keys stay in G8, and token limits, prompt rules and request records apply as they do to any API.
What AI Gateway coversIdentity and access spread across systems
With G8Authentication runs at the gateway, and each person gets a role per Environment.
How API Security worksChanges without a record
With G8Every change passes a role check and is recorded with its values before and after.
How the audit log works
Limits, identity, logs and traffic rules for every API
G8 API Gateway runs every Plugin of the G8 engine and manages them from the G8 console.
Explore API GatewayLimit requests, request rates and concurrent connections by client, Consumer or a key you choose.
Verify callers with OpenID Connect, LDAP, SAML, Keycloak, JWTs, API keys or signed requests, and accept more than one method on the same Route.
Traffic Explorer shows the gateway’s own request records. Analytics shows request counts beside the changes made in the same window. Alerts tells your team when a rule or a gateway node needs attention.
Records stay in your Elasticsearch or OpenSearch, counts in your Prometheus.
Observability in API GatewayRewrite requests and responses on their way through the gateway, including gRPC transcoding.
Split traffic between upstream versions for canary releases, and stop sending requests to a failing backend.
Check requests against a JSON schema or against your OpenAPI document before they reach the backend.
AI traffic under the same rules as your APIs
G8 AI Gateway serves your existing APIs to AI agents and sends requests to the LLM providers you choose.
Explore AI GatewayServe your existing APIs to AI agents, with the rules they already have
Add the openapi-to-mcp Plugin to a Route and point it at an API’s OpenAPI document. MCP clients, such as AI agents, can then call the API’s operations as tools.
- Your identityMCP clients sign in like any other client.
- Your limitsRate limits count tool calls as requests.
- Your logsTool calls appear in Traffic Explorer and in the logs you already send.
Send each request to the provider you choose, and fall back to another one when a provider returns a server error or is rate limited. Provider keys stay in the Plugin, masked for roles that can’t manage it.
Limit the tokens that traffic to a model can use in a time window.
Allow or refuse prompts by patterns you define, build prompts from your own templates and add your instructions before or after the user’s prompt.
Answer a prompt from the cache when it matches an earlier one exactly or by meaning, instead of sending it to the model again.
Add documents retrieved from a vector search to the prompt before it reaches the model.
Send request content to a moderation service before the model sees it.
Check prompts with Lakera Guard before they reach the model.
API Security and Developer Portal
API SecuritySecurity that runs at the gateway and in the console
Authentication, access rules, request validation and data masking run on your Routes. Certificates and secrets are managed in G8.
A catalog for the developers who use your APIs
Documentation and self-service access for the developers who use your APIs. Included in the G8 license.
- API catalog
- Documentation
- Self-service access
Environments, roles and audit, across all four areas
Environments, access rules and the audit log are one layer of G8, and it applies to all four areas.
Development, Staging and Production in the same console
Each gateway cluster is its own Environment. Before you copy a Route, Service or Upstream to another Environment, G8 shows what the copy will change there.
- SecretsCopied only while “Copy secrets too” is selected.
- Missing dependenciesObjects the copy refers to that don’t exist in the target yet.
- What will changeIf the object already exists in the target, the copy replaces it, and the lines it adds and removes are listed.
Who can change what, and how G8 records it
Roles per Environment
Give each person a role in a specific Environment, or in all of them. A role granted for Staging gives no access to Production. Use the built-in roles or build your own from a permission grid.
Recorded before it’s applied
A change through G8 passes a role check, and an audit record is opened before it’s applied. If the record can’t be written, or the G8 engine refuses the change, nothing is applied.
Every part of G8 runs in your infrastructure
The console and management API sit beside the traffic path. API traffic doesn’t pass through them.
Guides and articles from the G8 team
See your APIs and your AI traffic behind one gateway
Our team walks you through G8 with traffic like yours: how access and audit work, and where it fits in your infrastructure.
- 01Demo
- 02Proof of conceptOn Docker for a quick start, or on the infrastructure you plan to run G8 on.
- 03LicenseWe prepare a quote for your edition and nodes, and you receive a signed license file.