Open-Source and AISIX Cloud Operating Models
AISIX is available as the open-source AISIX gateway or AISIX Cloud. Both use the same gateway runtime, which always runs in customer-managed infrastructure.
The open-source AISIX gateway is available under Apache 2.0 and runs as a standalone product without a control plane. AISIX Cloud is API7's commercial product for managing AISIX gateways. It adds control-plane workflows for resource management, gateway certificate issuance, usage reporting, and budgets.
AISIX Cloud has two control-plane deployment options:
- Hybrid Cloud: API7 hosts the control plane. You run the gateway data plane in your infrastructure and manage resources through the dashboard or AISIX Cloud Admin API.
- On-Premises: You host the control plane and run the gateway data plane in your infrastructure, including fully air-gapped environments. You manage resources through the same dashboard or AISIX Cloud Admin API.
Both deployment options provide the same resource model and gateway workflow. The difference is who hosts the control plane and where its data is stored.
Deployment Topology
The topology differs in where the management layer runs and how configuration reaches the gateway. Operators access an AISIX Cloud control plane through its dashboard or the AISIX Cloud Admin API.
Compare Operating Models
| Open-source AISIX gateway | Hybrid Cloud | On-Premises | |
|---|---|---|---|
| Gateway runtime | Runs in your infrastructure | Runs in your runtime environment | Runs in your infrastructure |
| Management layer | Declarative resources.yaml file | API7-hosted AISIX Cloud control plane with dashboard and AISIX Cloud Admin API | Customer-hosted AISIX Cloud control plane with dashboard and AISIX Cloud Admin API |
| Configuration delivery | You declare dynamic resources in a resources.yaml file, set process-wide settings in startup configuration, and reload the gateway to apply changes | The control plane projects environment resources to AISIX gateways | The on-premises control plane projects environment resources to AISIX gateways |
| Operational ownership | You operate the gateway, its resources file, management integrations, and upgrades | You operate the gateway; API7 operates the control plane | You operate the complete private deployment with commercial delivery and support options |
| Network boundary | Gateway configuration stays in systems you operate; upstream traffic and exported telemetry follow configured destinations | Live proxy traffic bypasses the control plane; the gateway connects outbound to the API7-operated control plane for management and telemetry | Control-plane data and management services stay in your environment; upstream traffic and exported telemetry follow configured destinations |
| Best fit | Teams that need the gateway runtime and can build or operate their own management workflows | Teams that want AISIX Cloud control-plane workflows without operating the control plane | Teams with data-residency, network-isolation, compliance, or air-gap requirements |
In every option, applications call the AISIX gateway rather than the management layer. The gateway then calls the configured upstream model, MCP server, or A2A agent.
Shared Gateway Capabilities
The AISIX gateway provides the traffic-processing capabilities used by all three operating models:
- OpenAI-compatible APIs for inference, Realtime, Files, Batches, and Fine-Tuning
- Anthropic-compatible Messages and Cohere-style rerank requests
- Provider credentials and model aliases for hosted providers and OpenAI-compatible private endpoints
- Multi-target routing, retries, fallback, semantic routing, and ensemble models
- Caller API keys, model access controls, request and token rate limits, and concurrency limits
- Guardrails, response caching, metrics, logs, and external observability exporters
- MCP and A2A proxying, upstream authentication, access control, traffic controls, and observability
With the open-source gateway, declare dynamic resources in a resources.yaml file and set process-wide settings in startup configuration. You also operate gateway upgrades, credential-handling processes, and external reporting systems.
AISIX Cloud adds the control plane and dashboard without replacing the gateway traffic-processing layer.
AISIX Cloud Capabilities
The AISIX Cloud control plane adds organization-level workflows and operational services around the gateway runtime.
| Capability | Open-source AISIX gateway | AISIX Cloud |
|---|---|---|
| Gateway resource management | Declarative resources.yaml file for dynamic resources, startup configuration for process settings, and self-managed workflows | Dashboard and AISIX Cloud Admin API with environment-scoped resource management |
| Organizations and environments | Build or integrate your own ownership model | Organization ownership, isolated environments, members, teams, and roles |
| Caller API keys | Declare API-key resources and model allowlists in the resources file | Add ownership, team bindings, lifecycle workflows, usage attribution, and visual management |
| Provider credentials | Manage provider-key resources and their storage in your own environment | Envelope-encrypted, write-only provider secrets, environment eligibility, dependency visibility, and in-place credential rotation |
| Data-plane operations | Deploy, secure, monitor, and upgrade gateway instances yourself | Certificate issuance, mTLS bootstrap, registration, heartbeat, configuration projection, and status visibility |
| Usage and cost | Export logs and metrics to systems you operate | Request logs and Usage views for request volume, tokens, spend, and cache savings |
| Model pricing | Integrate your own pricing and accounting system | AISIX Cloud model-price catalog, organization overrides, and per-request cost calculation |
| Budgets | Not available without the AISIX Cloud control plane | Organization, environment, caller API key, provider key, team, and member budgets with warning or blocking enforcement |
| Audit trail | Use gateway logs and external audit systems | Request logs plus an audit trail for control-plane resource and access changes |
| MCP and A2A management | Declare servers, agents, authentication, and caller access in the resources file | Dashboard and AISIX Cloud Admin API workflows for servers, agents, tool or agent grants, usage, and audit |
| Deployment and delivery | Community documentation and customer-managed deployment | Hybrid Cloud or commercial On-Premises delivery using Docker Compose, Helm, or an offline package |
Commercial capabilities can vary by offering and release. Contact API7 when you need to confirm a capability for a specific deployment or commercial agreement.
Open-Source AISIX Gateway
The open-source option provides direct control of the gateway and its surrounding infrastructure without requiring a commercial AISIX subscription. It suits teams that need the gateway runtime and plan to integrate it into an existing platform or build their own management workflows. Your team remains responsible for infrastructure and operating costs.
The proxy listener serves application traffic. Dynamic resources are declared in a resources.yaml file that the gateway loads at startup and reloads on SIGHUP. The private admin listener remains available for reads and health checks; the AISIX Admin API write path is deprecated in favor of the declarative file. You own the deployment topology, admin access, credentials, monitoring, backups, and upgrades.
Start with the Open-Source AISIX Gateway Quickstart, then review Production Deployment before serving production traffic. To manage several gateways from one place, use the AISIX Cloud control plane instead — see the On-Premises AISIX Cloud Quickstart.
Hybrid Cloud
In Hybrid Cloud, the gateway runs in your environment and connects to the API7-hosted AISIX Cloud control plane.
The local Admin API is not available. You manage resources through the dashboard or AISIX Cloud Admin API, and the control plane projects environment-scoped configuration to the gateway. The gateway connects with certificate-based mTLS, serves live AI traffic, reports telemetry, and performs AISIX Cloud budget checks through its control-plane connection.
Live proxy traffic does not pass through the control plane. Applications call the AISIX gateway, and the gateway calls upstream providers or agent endpoints directly.
See AISIX Cloud and Connect an AISIX Gateway for the commercial operating model.
On-Premises
On-Premises keeps the AISIX Cloud control plane, its data, and gateway management services inside infrastructure you control.
You deploy the control-plane API, data-plane manager, dashboard, and database in your infrastructure. You manage resources through that dashboard or AISIX Cloud Admin API. The on-premises package provides the same resource model and gateway workflow as Hybrid Cloud. It supports online installation with Docker Compose or Helm and offline installation from an air-gapped package.
See On-Premises Deployment for installation options and On-Premises Configuration for deployment settings.
Move between Operating Models
The proxy API and gateway runtime stay consistent across the operating models, so application integrations can continue using the same AISIX endpoint conventions and model aliases.
The management path does change. Open-source gateway deployments load dynamic resources from a resources.yaml file. Gateways connected to AISIX Cloud receive resources from the control plane and do not expose the local AISIX Admin API. Plan to recreate or migrate gateway resources when moving to an AISIX Cloud control plane; do not treat the change as an in-place switch of the startup configuration.