Aurabase Logo
aurabasedocs
docs›Services›AI Gateway

AI Gateway

Sovereign European AI gateway in Rust: OpenAI, Anthropic, Gemini, sub-10ms pgvector search, ephemeral capability tickets, and NL2SQL.

8 min read·Level intermediate·Revised on Oct 31, 2026
#
Overview

One endpoint, N providers

The Aurabase AI Gateway is a unified HTTP and SDK surface for major LLM providers. The same code runs against OpenAI, Anthropic, and Google Gemini — you only change provider or rely on the project default.

The gateway incorporates four native pillars:

  1. Automated Fallback: Automatically falls back to a secondary provider when the primary suffers upstream outages or timeouts (5xx/408).
  2. Ephemeral Sessions: Issues short-lived capability tickets (300s TTL) with bounded token budgets, eliminating API key exposure in client frontends.
  3. Multi-Dimension pgvector: Dedicated dimensional column routing (embedding_768, embedding_1536, embedding_3072) with sub-5ms HNSW similarity search.
  4. AST-Verified NL2SQL: Synthesizes PostgreSQL queries validated by an Abstract Syntax Tree parser that forbids mutations and enforces row limits.
#
Providers

Supported LLM & Embedding Models

ProviderChat & Completion ModelsSupported Embeddings
Anthropicclaude-3-5-sonnet, claude-3-5-haiku, claude-3-opus—
OpenAIgpt-4o, gpt-4o-mini, o1, o3-minitext-embedding-3-small (1536), text-embedding-3-large (3072)
Google Geminigemini-1.5-pro, gemini-1.5-flash, gemini-2.0-flashtext-embedding-004 (768)
Custom / OllamaAny OpenAI-compatible endpointCustom OpenAI-compatible embeddings
#
Capability

Ephemeral sessions (Zero secret exposure)

Frontend single-page applications and mobile apps should never embed backend API keys (aura_anon_... or aura_sk_...) for open-ended LLM endpoints. Aurabase solves this with ephemeral capability sessions:

functions/mint-session.tstypescript
// In your backend, Next.js Server Component, or Edge Function:
const session = await aura.ai.session()

// The session instance holds a 300s capability ticket signed with JWT HMAC:
const { content, budget_remaining } = await session.chat([
  { role: 'user', content: 'Summarize my dashboard statistics.' }
])
console.log('Tokens remaining in session:', budget_remaining)
Astuce

The ticket is bounded by the project's remaining monthly token quota. When the allocated session budget is depleted, the gateway rejects requests with HTTP 429 Too Many Requests (code: "session_budget_exceeded"), shielding your organization from client-side denial-of-wallet attacks.

#
Examples

Chat, streaming, pgvector & RAG

chat-stream.tstypescript
for await (const chunk of aura.ai.chatStream([
  { role: 'user', content: 'Draft a Data Processing Agreement clause under GDPR.' }
], { provider: 'anthropic', model: 'claude-3-5-sonnet', temperature: 0.1 })) {
  process.stdout.write(chunk.delta)
}
#
Observability

Audit logs & quotas

Every AI call is logged with prompt/completion tokens, reasoning tokens (Gemini thoughts included), provider, upstream model, duration, and status.

Real-Time Logs API

Inspect audit logs via GET /v1/ai/{project_id}/logs:

curlbash
curl "https://<slug>.aurabase.dev/v1/ai/$PROJECT_ID/logs?limit=10" \
  -H "apikey: $AURABASE_SERVICE_ROLE_KEY"
Info

Rate limits are enforced on a per-project token bucket (10 req/min with burst 5 by default). Monthly plan limits apply across ai.requests, ai.input_tokens, and ai.output_tokens. Exceeding monthly plan limits returns HTTP 403 Forbidden (QUOTA_EXCEEDED).

Last updated · Oct 31, 2026