Enterprise LLM Gateway: Govern Team LLM API Access

The Enterprise LLM Gateway lets your organization route all LLM API traffic through a single, governed endpoint. Admins configure provider credentials once. Teams receive scoped gateway keys — not raw provider secrets. Every call is logged with full org and team attribution, so admins and team leads can inspect usage from the same session and analytics surfaces they already use.

Not rclm-proxy. The Enterprise Gateway is hosted at https://proxy.reclaimllm.com/<org-slug>/v1 with a team gateway key (rclm-gw-…). The Local API Proxy is a separate developer tool (rclm-proxy on http://localhost:9800) that uses personal provider keys. They are not interchangeable.

How it works

Instead of giving every developer direct access to an OpenAI, Anthropic, Gemini, or Azure OpenAI key, your team points its requests at the ReclaimLLM gateway URL and uses a team gateway key as the bearer token. The gateway validates the key, checks provider and model access against the policy you configured, forwards the request to the correct upstream provider, and logs the result.

The team gateway key is not a provider API key. It is a ReclaimLLM key that authorizes access according to your org’s configured provider policy. Developer machines never receive the upstream provider secret.

Setup

Open the LLM Gateway page

Store provider credentials

Add credentials for the providers your organization wants to use. The gateway currently supports OpenAI, Azure OpenAI, Anthropic, Gemini, Moonshot, and DeepSeek. Credentials are stored server-side and never exposed to developers.

Create a team-scoped gateway key

Click New gateway key, then:

Select the team that will use this key.
Give the key a descriptive name (for example, backend-team-prod).
Choose the allowed providers and, optionally, restrict to specific models or model patterns.

Copy the key immediately — it is shown only once.

Follow the model naming contract

Requests must send a LiteLLM-prefixed model ID (for example openai/gpt-5.6-luna). The org catalog and key allowlist store the bare name after the prefix (gpt-5.6-luna). See Model naming contract.

Update your app's base URL and auth header

Point your application or SDK at the enterprise gateway URL and swap in the team gateway key as the bearer token. No other code changes are required.

Base URL:  https://proxy.reclaimllm.com/<your-org-slug>/v1
Auth:      Authorization: Bearer rclm-gw-your-team-key

Review traffic in enterprise reporting

Admins and team leads can inspect logged proxy requests under Enterprise → Reporting and from team session views. Each logged call includes org, team, model, duration, token counts, and gateway key metadata.

The gateway runs as a separate hosted service at proxy.reclaimllm.com, distinct from the main reclaimllm.com app and from local rclm-proxy (http://localhost:9800). Always use the proxy.reclaimllm.com host for enterprise gateway requests — never substitute localhost.

Request examples

The gateway exposes an OpenAI-compatible API on https://proxy.reclaimllm.com/<org-slug>/v1. Use the LiteLLM model naming convention — prefix the model name with the provider — so the gateway can route the request. These curls match the copy-paste sample on the org LLM Gateway / API Keys page. Replace acme with your org slug and rclm-gw-your-team-key with your team gateway key.

curl https://proxy.reclaimllm.com/acme/v1/chat/completions \
  -H "Authorization: Bearer rclm-gw-your-team-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-5.6-luna",
    "messages": [
      { "role": "user", "content": "Write a short release note." }
    ]
  }'

Streaming is supported — set "stream": true in the request body and read the response as server-sent events.

curl https://proxy.reclaimllm.com/acme/v1/chat/completions \
  -H "Authorization: Bearer rclm-gw-your-team-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "moonshot/kimi-k2.6",
    "messages": [
      { "role": "user", "content": "Compare FCF of amazon and microsoft?" }
    ]
  }'

Chat completions through the Azure OpenAI org credential:

curl https://proxy.reclaimllm.com/acme/v1/chat/completions \
  -H "Authorization: Bearer rclm-gw-your-team-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/gpt-4o-mini",
    "messages": [
      { "role": "user", "content": "Summarize this incident report." }
    ]
  }'

Use the deployment / model name your org catalog stores as the bare name after azure/.

Embedding traffic uses the same team gateway key and org policy as chat.Azure OpenAI embeddings:

curl https://proxy.reclaimllm.com/acme/v1/embeddings \
  -H "Authorization: Bearer rclm-gw-your-team-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/text-embedding-3-small",
    "input": ["Searchable context from an LLM session."]
  }'

OpenAI embeddings:

curl https://proxy.reclaimllm.com/acme/v1/embeddings \
  -H "Authorization: Bearer rclm-gw-your-team-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/text-embedding-3-small",
    "input": ["Session context for semantic retrieval."]
  }'

The gateway also proxies the Responses API for providers that support it. Same host, auth, and org-slug pattern as chat completions.

curl https://proxy.reclaimllm.com/acme/v1/responses \
  -H "Authorization: Bearer rclm-gw-your-team-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-5.6-luna",
    "input": "Summarize this incident report."
  }'

Responses API support depends on the underlying provider and LiteLLM version behind the gateway. If LiteLLM aresponses is unavailable in the runtime, the gateway returns:

{"detail":"LiteLLM responses API is not available in this runtime"}

with HTTP 501.

The gateway is OpenAI-compatible, so you can use the OpenAI Python SDK by overriding base_url and api_key.

from openai import OpenAI

client = OpenAI(
    base_url="https://proxy.reclaimllm.com/acme/v1",
    api_key="rclm-gw-your-team-key",
)

response = client.chat.completions.create(
    model="openai/gpt-5.6-luna",
    messages=[
        {"role": "user", "content": "Write a short release note."}
    ],
)

print(response.choices[0].message.content)

Switch providers by changing the model prefix — no other changes required:

# Moonshot
response = client.chat.completions.create(
    model="moonshot/kimi-k2.6",
    messages=[{"role": "user", "content": "Compare FCF of amazon and microsoft?"}],
)

# Azure OpenAI
response = client.chat.completions.create(
    model="azure/gpt-4o-mini",
    messages=[{"role": "user", "content": "Summarize this incident report."}],
)

The gateway is OpenAI-compatible, so you can use the OpenAI Node.js SDK by overriding baseURL and apiKey.

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://proxy.reclaimllm.com/acme/v1",
  apiKey: "rclm-gw-your-team-key",
});

const response = await client.chat.completions.create({
  model: "openai/gpt-5.6-luna",
  messages: [
    { role: "user", content: "Write a short release note." },
  ],
});

console.log(response.choices[0].message.content);

Switch providers by changing the model prefix — no other changes required:

// Moonshot
await client.chat.completions.create({
  model: "moonshot/kimi-k2.6",
  messages: [{ role: "user", content: "Compare FCF of amazon and microsoft?" }],
});

// Azure OpenAI
await client.chat.completions.create({
  model: "azure/gpt-4o-mini",
  messages: [{ role: "user", content: "Summarize this incident report." }],
});

Model naming contract

The gateway uses the LiteLLM provider prefix to route requests. Requests must be prefixed. Org catalog and key allowlists store the bare name.

Surface	Form	Example
Request `model`	Prefixed LiteLLM ID	`openai/gpt-5.6-luna`, `moonshot/kimi-k2.6`
Org model catalog	Bare name after the provider prefix	`gpt-5.6-luna`, `kimi-k2.6`
Key allowlist (`allowed_models`)	Bare name, keyed by provider	`{"openai": ["gpt-5.6-luna"], "moonshot": ["kimi-k2.6"]}`

Bare gpt-5.6-luna is rejected. Use openai/gpt-5.6-luna. Supported request prefixes: openai/, azure/, azure_openai/, anthropic/, gemini/, moonshot/, deepseek/. Exception: bare text-embedding-* is treated as OpenAI.

Provider	Request model string	Allowlist / catalog name
OpenAI	`openai/gpt-5.6-luna`	`gpt-5.6-luna`
Azure OpenAI	`azure/text-embedding-3-small`	`text-embedding-3-small`
Anthropic	`anthropic/claude-3-5-sonnet-20241022`	`claude-3-5-sonnet-20241022`
Google Gemini	`gemini/gemini-1.5-pro`	`gemini-1.5-pro`
Moonshot	`moonshot/kimi-k2.6`	`kimi-k2.6`
DeepSeek	`deepseek/deepseek-chat`	`deepseek-chat`

Exact error bodies

Gateway policy and naming errors use FastAPI’s { "detail": "..." } JSON body.

Status	`detail`	When
`422`	`Model must include a supported LiteLLM provider prefix`	Request model has no recognized provider prefix (for example bare `gpt-5.6-luna`)
`403`	`Provider is not allowed for this key`	Key’s `allowed_providers` does not include the inferred provider
`403`	`Model is not configured for this org`	Bare name is missing from the org gateway model catalog
`403`	`Model is disabled for this org`	Catalog entry exists but is disabled
`403`	`Model is not allowed for this key`	Key allowlist / model-pattern policy rejects the model
`403`	`Organization is not active`	Org is disabled
`403`	`Gateway key is not valid for this org`	Key org slug does not match the URL slug
`501`	`LiteLLM responses API is not available in this runtime`	`/v1/responses` when LiteLLM `aresponses` is missing

Policy checks run before the upstream provider call. A 403 here is gateway policy, not an OpenAI/Azure rejection.

Optional request params

The gateway forwards OpenAI-compatible optional fields such as service_tier to LiteLLM / the upstream provider. OpenAI and Azure OpenAI accept request-level service_tier values including auto, default, and priority (Flex where the deployment supports it). Credential and routing fields (api_key, api_base, headers, and similar) are still stripped and ignored.

What gets logged

Every gateway call creates a proxy session record. These records appear in enterprise reporting and team session views alongside other captured AI activity.

Field	What’s recorded
Identity	Org ID, team ID, gateway key metadata, attributed team lead
Request	Endpoint, method, model, streaming flag, sanitized request payload metadata
Response	Status code, duration, input tokens, output tokens, provider response metadata
Access	Visible to enterprise admins and team leads scoped to the relevant org/team

Logging failures do not block a successful provider response. If the log write fails, the upstream response is still returned to the caller, and the record is queued locally for retry.

Team-scoped policy

You can configure different policies for different teams. For example:

The backend team has access to OpenAI and Anthropic.
The data team is restricted to Gemini and Azure embeddings only.
A prototype service has access to a single model pattern.

Each gateway key enforces its policy independently. Revoking a key immediately cuts off access for that team without affecting other keys or the upstream provider credentials.

Current limitations

The gateway is a new release. Read these limitations before putting it on a critical production path.

Org-level provider credentials only

Provider credentials are configured at the organization level. Team-owned provider credentials and team-specific provider billing separation are not available in this version.

Gateway reliability is in your request path

The gateway now sits between your application and the upstream provider. Uptime and retry behavior matter more than for passive capture paths. We recommend evaluating it in a non-critical service before routing production traffic through it.

Provider compatibility is still maturing

Provider APIs differ around streaming, token reporting, and response shapes. Most edge cases have been addressed, but streaming behavior and provider-specific response formats may surface issues in production. Share feedback at [email protected].

Provider list is expanding

Supported providers today: OpenAI, Azure OpenAI, Anthropic, Gemini, Moonshot, and DeepSeek. Additional providers will be added based on enterprise demand.

Get Started

Capture

User Portal

Privacy & Security

Enterprise

Plans & Billing

Enterprise LLM Gateway: Govern Team LLM API Access

How it works

Setup

Request examples

Model naming contract

Exact error bodies

Optional request params

What gets logged

Team-scoped policy

Current limitations

Next steps

Observability

Roles & Access

​How it works

​Setup

​Request examples

​Model naming contract

​Exact error bodies

​Optional request params

​What gets logged

​Team-scoped policy

​Current limitations

​Next steps

Observability

Roles & Access

How it works

Setup

Request examples

Model naming contract

Exact error bodies

Optional request params

What gets logged

Team-scoped policy

Current limitations

Next steps