How theopenco/llmgateway works
1. This repository is a multi-app monorepo for an LLM gateway product, split into a hot-path inference layer and a control-plane/product layer. The main runtime pieces are a Hono-based backend API, a dedicated gateway service, several Next.js apps, a background worker, and shared packages for data, models, caching, and utilities.
2. The core data-plane is apps/gateway. It accepts OpenAI-compatible requests and also exposes specialized endpoints for embeddings, images, OCR, speech, video, and responses. Its job is to normalize requests, choose providers and fallback paths, translate provider-specific formats, and enforce routing, rate limits, and capability checks before sending traffic to external LLM providers.
3. The gateway’s outbound dependencies are the actual model providers: OpenAI, Anthropic, Google/Vertex, AWS Bedrock, Azure, DeepSeek, Mistral, xAI, etc. Provider/model metadata lives in packages/models, while request transformation and provider selection logic is concentrated in packages/actions and apps/gateway/src/chat/tools. That is the main abstraction boundary for “provider-agnostic” LLM access.
4. Persistence and operational state are centered on PostgreSQL and Redis. packages/db contains the schema, migrations, seed data, and query helpers for organizations, projects, API keys, logs, metrics, billing, discounts, and webhooks. Redis is used for caching, SWR-style query support, rate limiting, and transient gateway state. In diagrams, this is the shared state layer beneath the API, gateway, worker, and admin surfaces.
5. apps/api is the main backend control plane. It exposes endpoints for authentication, organizations, projects, keys, billing, analytics, audit logs, referrals, platform sessions, webhooks, and public configuration. This service is where the product’s account management and platform administration logic lives, distinct from the inference traffic handled by the gateway.
6. apps/ui, apps/playground, apps/code, and ee/admin are separate Next.js frontends with different audiences. apps/ui is the public marketing site plus the customer dashboard; apps/playground is the interactive product demo and authenticated sandbox; apps/code focuses on coding-agent/dev-plan content and user-facing plan management; ee/admin is an internal enterprise operations console. They all consume the backend API and shared data layer, but each has a distinct UX and domain scope.
7. apps/worker handles asynchronous and scheduled processing. It aggregates stats, syncs models, processes follow-up emails, and manages video-related jobs. This is the repository’s background-processing boundary: anything that should not block request/response flows is pushed here, usually reading from or writing to the same database and telemetry streams used by the API and gateway.
8. There is a clear separation between synchronous request handling and analytics/metadata processing. The gateway records logs and metrics about model usage, cost, latency, retries, and failures; the worker compacts or aggregates that data into project/global stats; the UI and admin dashboards query those aggregates for charts, tables, and cost/usage views. This is the main analytics data flow in the system.
9. Authentication and authorization are shared concerns but applied differently across surfaces. The API and dashboards use app-level auth, while the gateway also validates API tokens and provider credentials for inference requests. Enterprise and platform features such as org/team access, master keys, provider keys, billing, and guardrails sit behind these auth boundaries.
10. The ee/ directory adds enterprise-only modules and UI. The notable runtime pieces are ee/guardrails for policy and redaction enforcement, ee/audit for structured audit logging, and ee/admin for the internal admin dashboard. These are layered on top of the core OSS platform and share the same general data and identity model.
11. Docs and content are first-class but architecturally separate. apps/docs is a documentation site with MDX content and API/search/proxy routes, while apps/ui and apps/code also host large content libraries for blog posts, changelogs, guides, comparisons, and legal pages. These sites are mostly read-only content delivery, not part of the runtime LLM request path.
12. Deployment supports both split and unified topologies. The repo includes Docker Compose variants, unified and split Dockerfiles, Helm charts, and run scripts. In a diagram, the unified deployment bundles the gateway, API, frontends, worker, PostgreSQL, and Redis; the split deployment treats the gateway as a separate service from the control-plane apps.
13. Shared libraries are intentionally kept small and domain-focused. packages/shared contains cross-app utilities like routing config, token estimation, load balancing, URL safety, fees, video access, and shared UI primitives; packages/cache and packages/logger provide infrastructure helpers; packages/instrumentation provides tracing, metrics, and request lifecycle hooks. These packages are the glue that keeps the monorepo consistent across services.
Main entry points: api API · infra Deploy · chat Chat flow · gateway Gateway
Components 19
Data plane
Hot-path inference and provider routing
- Gateway · OpenAI-compatible request handling, specialized multimodal endpoints, routing, fallback, and provider translation
apps/gateway - Chat flow · Normalizes chat requests, applies routing and fallback, and streams responses
apps/gateway/src/chat - Gateway APIs · Embeddings, images, OCR, speech, video, moderations, models, MCP, and responses endpoints
apps/gateway/src
Control plane
Product APIs, dashboards, docs, and admin surfaces
- API · Authentication, org/project management, keys, billing, analytics, audit logs, referrals, sessions, webhooks, and public config
apps/api - UI · Marketing site and customer dashboard for usage, billing, settings, and product content
apps/ui - Playground · Interactive product demo for chat, image, audio, video, and org/project experiences
apps/playground - Code site · Coding-agent content, comparisons, and plan management for the dev audience
apps/code - Docs · MDX docs, API/search/proxy routes, self-hosting guides, and feature docs
apps/docs - Worker · Async aggregation, model sync, follow-up emails, and video jobs
apps/worker
Shared layer
Common state, models, utilities, and telemetry
- Actions · Provider selection, request preparation, message transforms, headers, and endpoint resolution
packages/actions - Models · Provider and model metadata, capabilities, regions, and compliance information
packages/models - Database · Organizations, projects, keys, billing, logs, metrics, discounts, and webhooks schema plus helpers
packages/db - Cache · Redis-backed caching, SWR query support, and transient shared state
packages/cache - Shared utils · Routing config, token estimation, load balancing, URL safety, fees, and shared UI primitives
packages/shared - Instrumentation · Tracing, metrics, request lifecycle hooks, and sampling
packages/instrumentation
Enterprise
Enterprise-only policy and admin extensions
- Guardrails · Enterprise policy, redaction, and content restriction enforcement
ee/guardrails - Audit · Structured enterprise audit logging and schema
ee/audit - Admin · Internal operations console for orgs, providers, models, rate limits, discounts, and stats
ee/admin
Operations
Deployment and runtime orchestration
- Deploy · Unified and split Docker, Compose, Helm, and startup scripts for the monorepo services
infra
Connections 36
- Gateway → Chat flow: serves · Main inference path is implemented in the chat pipeline
- Gateway → Gateway APIs: exposes · Gateway also serves specialized modality and utility endpoints
- Chat flow → Actions: transforms via · Request normalization and provider-specific payload work is delegated to shared actions
- Chat flow → Models: resolves · Model selection and capability checks use shared model metadata
- Chat flow → Database: reads/writes · Logs, keys, routing config, and usage state persist in Postgres
- Chat flow → Cache: caches · Rate limiting, SWR data, and transient gateway state use Redis
- Chat flow → Instrumentation: emits · Tracing and metrics are recorded around request handling
- Gateway APIs → Actions: uses · Non-chat endpoints still share request transformation and provider logic
- Gateway APIs → Models: validates · Endpoint availability depends on model and provider capabilities
- Gateway → Guardrails: enforces · Enterprise policy checks can block or redact inference requests
- Gateway → Audit: logs · Security-relevant gateway events feed enterprise audit trails
- API → Database: persists · Control-plane data is managed through the shared database schema
- API → Cache: uses · Some API flows rely on shared Redis-backed caching
- API → Instrumentation: traces · API requests are instrumented for observability
- UI → API: consumes · Dashboard and account flows are backed by the control-plane API
- Playground → API: consumes · Playground identity, org, key, and plan flows use the API
- Code site → API: consumes · Coding-plan and profile flows depend on the backend API
- Docs → API: documents · Docs describe the public API and product behavior
- Worker → Database: aggregates · Background jobs read logs and usage data to build stats
- Worker → Cache: coordinates · Jobs and transient processing state can use Redis
- Worker → Instrumentation: reports · Worker execution is observable through shared telemetry
- Worker → API: supports · Async processing backs account and analytics experiences
- Admin → API: administers · Enterprise console surfaces and mutates platform state through backend APIs
- Admin → Database: queries · Admin dashboards read from shared operational data
- Admin → Audit: reviews · Audit records are part of the internal admin workflow
- Guardrails → Gateway: guards · Policy engine sits on the inference path for sensitive requests
- Guardrails → API: configures · Guardrail settings are managed from control-plane surfaces
- Deploy → Gateway: deploys · Deployment manifests include the gateway service
- Deploy → API: deploys · Deployment manifests include the API service
- Deploy → UI: deploys · Deployment manifests include the customer UI
- Deploy → Playground: deploys · Deployment manifests include the playground app
- Deploy → Code site: deploys · Deployment manifests include the coding site
- Deploy → Docs: deploys · Deployment manifests include the docs site
- Deploy → Worker: deploys · Deployment manifests include the background worker
- Deploy → Database: provisions · PostgreSQL is part of the bundled runtime topology
- Deploy → Cache: provisions · Redis is part of the bundled runtime topology