OpenAI

In this guide, you will connect AISIX AI Gateway to OpenAI. Callers reach GPT models through the gateway's OpenAI-compatible API, while AISIX owns the credential, model allowlist, rate limits, and usage accounting.

Use this configuration when applications should authenticate to AISIX with a caller API key instead of holding your OpenAI key directly. OpenAI is the gateway's native upstream: it uses the openai adapter, and it is the one provider where api_base is optional.

Prerequisites

Before starting, prepare the following:

A gateway with the admin API on :3001 and the proxy API on :3000.
The admin key from the gateway config.yaml.
An OpenAI API key from the OpenAI platform and the model ID you want to expose, for example gpt-4o.

Supported Capabilities

OpenAI has the broadest endpoint coverage of any upstream, because the gateway's own API surface is OpenAI-shaped.

Endpoint	Supported	Streaming	Notes
`/v1/chat/completions`	Yes	Yes	Primary path.
`/v1/embeddings`	Yes	—	Embeddings require the `openai` adapter.
`/v1/responses`	Yes	Yes	Forwarded to OpenAI verbatim.
`/v1/images/generations`	Yes	—	Requires `provider: "openai"`.
`/v1/audio/transcriptions`, `/v1/audio/translations`, `/v1/audio/speech`	Yes	—	OpenAI-style audio forwarding (transcription, translation, speech).
`/v1/rerank`	Yes	—	`provider` must be in the rerank allowlist (`openai`, `cohere`, `jina`).

See Provider Compatibility for the exact per-endpoint rules.

Configure the OpenAI Upstream

Create a provider key, model alias, and caller API key for the OpenAI-backed route.

Create a Provider Key

export AISIX_ADMIN_KEY="YOUR_ADMIN_KEY"
export OPENAI_API_KEY="YOUR_PROVIDER_API_KEY"

curl -sS -X POST "http://127.0.0.1:3001/admin/v1/provider_keys" \
  -H "Authorization: Bearer ${AISIX_ADMIN_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "display_name": "openai-prod",
    "provider": "openai",
    "adapter": "openai",
    "secret": "'"${OPENAI_API_KEY}"'"
  }'

❶ provider is openai. This is the only provider value that lets AISIX fall back to the default base URL https://api.openai.com/v1.

❷ adapter selects the OpenAI wire format.

❸ secret stores the OpenAI API key. It follows the credential-handling behavior in Provider Credentials.

You can omit api_base for OpenAI. To target a compatible OpenAI endpoint such as an Azure-fronted proxy or a regional gateway, set api_base explicitly. Copy the returned provider key ID.

Create a Model

export PROVIDER_KEY_ID="YOUR_PROVIDER_KEY_ID"

curl -sS -X POST "http://127.0.0.1:3001/admin/v1/models" \
  -H "Authorization: Bearer ${AISIX_ADMIN_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "display_name": "gpt-4o-prod",
    "provider": "openai",
    "model_name": "gpt-4o",
    "provider_key_id": "'"${PROVIDER_KEY_ID}"'"
  }'

❶ display_name is the alias callers send in model.

❷ model_name is the OpenAI model ID, for example gpt-4o or gpt-4o-mini.

❸ provider_key_id attaches the alias to the OpenAI provider key.

Create a Caller API Key

Choose the caller API key value that the application will send to AISIX, then hash it for the admin resource:

export AISIX_API_KEY="YOUR_CALLER_API_KEY"

CALLER_KEY_HASH=$(printf '%s' "${AISIX_API_KEY}" | shasum -a 256 | awk '{print $1}')

curl -sS -X POST "http://127.0.0.1:3001/admin/v1/apikeys" \
  -H "Authorization: Bearer ${AISIX_ADMIN_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "key_hash": "'"${CALLER_KEY_HASH}"'",
    "allowed_models": ["gpt-4o-prod"]
  }'

❶ allowed_models must match the model alias you created.

Verify the Upstream

Send a chat-completions request through the AISIX proxy:

curl -sS -X POST "http://127.0.0.1:3000/v1/chat/completions" \
  -H "Authorization: Bearer ${AISIX_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-prod",
    "messages": [{"role": "user", "content": "Say hello from OpenAI."}]
  }'

The gateway returns an OpenAI-compatible response that echoes the caller-facing alias gpt-4o-prod. Confirm the request on the OpenAI usage dashboard. If AISIX returns an upstream authentication error, check the provider key secret.

Behavior and Limits

Point OpenAI SDK clients at the gateway by setting the base URL to http://127.0.0.1:3000/v1 and the API key to the caller key. See the OpenAI SDK Quickstart.

The gateway hashes and stores caller keys as key_hash; the raw key is never stored. Provider key secrets are returned as *** in Admin API list views.

Next Steps

OpenAI SDK Quickstart — call this alias from the OpenAI Python or Node.js SDK.
Model Aliases — add routing, cost metadata, and rate limits.
Provider Compatibility — the endpoint-by-endpoint support rules.

Prerequisites​

Supported Capabilities​

Configure the OpenAI Upstream​

Create a Provider Key​

Create a Model​

Create a Caller API Key​

Verify the Upstream​

Behavior and Limits​

Next Steps​