Overview
AI Gateway lets every customer run your product's model requests through an AI provider account they already control (e.g. their OpenAI, Anthropic, AWS Bedrock, etc.).
Your backend keeps one OpenAI-compatible integration; Alien handles provider-specific credentials, IAM roles, regions, and routing for each customer.
For each customer, model requests use only the models they have approved and count against their existing provider or cloud commitment—not your AI bill. Your application never receives their provider credentials. This is BYO-LLM.
Your backend keeps one OpenAI-shaped client pointed at ai.alien.dev. Each request carries a customer ID, and Alien AI Gateway routes it to the AI provider account that customer connected — AWS Bedrock, Vertex AI, OpenAI, and others.
Without AI Gateway, every request uses provider credentials your company owns. You pay the inference bill, and customers cannot require your product to use the providers, cloud environments, or models they have approved. Enterprise buyers push back for two reasons:
- They already have committed AI spend. Large companies negotiate commitments with OpenAI, Anthropic, AWS, Google Cloud, or Microsoft. They want usage from your product to count toward that spend.
- They have AI governance requirements. Security or company policy may allow only specific providers, cloud environments, regions, or models.
With AI Gateway, your backend uses one endpoint. It identifies the customer and model on each request; Alien selects the correct provider connection.
Add it to an OpenAI client
Point an existing OpenAI client at Alien: change the base URL, send the customer ID as a header, and use a model ID that Alien lists for that customer.
import OpenAI from "openai"
const ai = new OpenAI({
baseURL: "https://ai.alien.dev/v1",
apiKey: process.env.ALIEN_AI_KEY,
defaultHeaders: {
"X-Alien-External-ID": customer.id,
},
})
const response = await ai.chat.completions.create({
model: "byo/claude-opus-5",
messages: [{ role: "user", content: "Hello" }],
})Three values in that example decide where the request goes:
| Value | What it selects |
|---|---|
| Alien API key | Your Alien project |
X-Alien-External-ID | Which of your customers the request is for |
model | Which model to use from that customer's provider connection |
Alien AI Gateway accepts requests shaped as OpenAI Chat Completions, OpenAI Responses, or Anthropic Messages, plus model discovery.
It routes by customer
Most AI gateways decide which provider or model should handle a request using connections that you configured. AI Gateway answers a different question first: which customer's provider connection should handle it?
X-Alien-External-ID selects the customer connection. model selects a model available through that connection. You can use AI Gateway alongside a model router; they solve different problems.
| Provider connection used | Model used | |
|---|---|---|
| Model router | One of the provider connections you configured | Chosen by your routing rules |
| Alien AI Gateway | The connection configured by that customer | Requested by your application from the models available through that connection |
How this relates to the rest of Alien
Alien can deploy your application into a customer's cloud so your code runs next to their data. AI Gateway does not move your application: your backend stays where it is, and only model requests are routed through the provider connection the customer supplied.
Use AI Gateway when customers need their approved providers and models but do not need to host your application. If a customer later needs your code running beside their data, How Alien works covers the deployment models that do that.
How customers connect a provider
Each customer connects their provider through a setup link your backend generates and shows inside your own product. The page carries your portal branding, and your application never receives the credentials the customer provides.
Setup depends on the provider:
| Provider | What your customer grants |
|---|---|
| OpenAI, Anthropic | An API key from their provider account |
| AWS Bedrock | An IAM role in their AWS account that Alien impersonates |
| Vertex AI, Azure AI Foundry | A cloud identity in their Google Cloud project or Azure tenant |
Only the first row is a plain API key. Each cloud provider requires its own trust setup, which the customer completes using their own cloud access — that is why connecting runs as a guided flow rather than a text field on your settings page. See Integrate with your product.
What Alien records
Gateway diagnostics record routing and outcome metadata for each request: model, provider, status, latency, and token counts. They do not record prompt or response bodies. Usage reporting aggregates that same metadata. See Requests and models.