Platform · AI Gateway

Every governed model call starts here.

The IntSen AI Gateway is the single entry point for your applications' and agents' model calls: it authenticates the caller, checks what it may use, applies your controls and records the result.

Book a live demo View the quickstart

Your apps & agents

your runtime · any framework

Support copilotField-service agentInternal assistant

IntSen AI Gateway

POST /openai/v1/chat/completions

waiting for a model call…

Approved model provider

OpenAI · gpt-5.4-mini

200 · streamed

Select a control to see what it does · synthetic example

The problem

Without one door, every team builds its own path to the model.

Provider keys end up in application configs, model choices go unreviewed, and there is no single record of who called what. Policies exist on paper but have no place to be enforced.

Provider keys spread across services and developers
No check that a model is approved for the use case or its data
No consistent record of calls, refusals and costs

Capabilities

What AI Gateway does

Authenticated access

Apps and agents sign in with OAuth client credentials. Team identity providers can be registered alongside the platform's own.

Registered use cases

Each call names its registration—the use case with owners, data class, approved models, budgets and capture policy.

Agent identification

The agent is recognized from its client and headers, so every call belongs to a named, owned agent.

Model permissions

A policy decision point checks client, registration, provider, endpoint and model against the catalog and data class.

Credential handling

Provider keys stay with the gateway and are injected per call. IntSen headers are removed before the provider sees the request.

Request recording

Every request is recorded with its cost, timings, verdicts and a refusal code when it is denied.

Technical detail

What happens on each call

In order, for every request that reaches the gateway:

Refusals carry a code

400 registration_id_required  no registration named on the call403 client_not_bound          client not bound to this registration403 provider_not_allowed      provider not approved for this registration403 model_not_allowed         model not allowed for this endpoint429 budget_exceeded           use-case or agent budget exhausted429 task_budget_exceeded      this turn went over its cost or time limit

1 · Authenticate: Validate the OAuth token and the client it was issued to.
2 · Resolve: Look up the registration and agent from headers and client; reject unknown or unapproved callers.
3 · Authorize: Check provider, endpoint and model against the registration, the model catalog and the data class.
4 · Validate: Refuse oversized or invalid requests before they reach the provider.
5 · Guard and budget: Run configured input guardrails; check use-case, agent and per-turn budgets.
6 · Route: Inject the provider key, strip IntSen headers, forward and stream the response.
7 · Record: Write the request, verdicts, tokens, cost and timings; hand the call to task tracking.

Why it matters

For the people accountable for it

CIO / AI platform

One controlled entry point for model access across teams, with every use case registered and owned.

CISO

Authenticated callers, approved models only, and no provider keys in application code.

Engineering

A drop-in base URL for existing OpenAI clients; streaming keeps working.

Boundaries

What to know before you evaluate

We would rather you hear the limits from us than discover them in a pilot.

The first release routes OpenAI (chat completions, Responses, embeddings, streaming). Azure OpenAI and Anthropic are planned.
Only traffic routed through the gateway is governed. Calls made with a direct provider key bypass IntSen; removing direct keys from teams is part of rollout.
The gateway adds processing to each call. We measure latency with you during a pilot rather than quote a figure.

FAQ

Common questions

Guardrails Spend management Observability & audit

We already have an AI gateway. Why IntSen?

A gateway routes and meters requests. IntSen uses its gateway as the control point for governance: every call belongs to a registered use case with owners, an agent and a turn, and the same records drive guardrails, budgets, tracing, evaluations and compliance. Evaluate whether your current gateway gives you that turn-level accountability in one place.

Do our apps still need provider API keys?

No. The gateway holds provider credentials and injects them per call. Your apps and agents hold only their IntSen OAuth client.

What do we change in our code?

The model client's base URL, its API key (now an IntSen OAuth token) and a few headers. Request and response formats stay the same.

Does streaming work?

Yes. Streamed responses pass through, and output checks run after completion—or during the stream if you switch that on.

Ready to make your enterprise AI accountable?

See how IntSen can help your teams govern access, safety, quality and spending across the AI applications and agents you already run.

Book a live demo Discuss an enterprise pilot