Port Reference

AISIX AI Gateway listener ports are configured in startup configuration. The Quickstart and self-hosted examples use the ports below so the proxy, admin API, and etcd endpoints do not overlap.

Port	Used By	Purpose	Exposure
3000	Proxy listener	Receives caller-facing AI API requests, such as /v1/chat/completions and /v1/models.	Expose only to intended callers or the ingress tier in front of the gateway.
3001	Admin listener	Receives self-hosted admin API requests that create and update dynamic resources. It can also serve health and OpenAPI routes.	Keep on loopback, a private subnet, or an admin-only network.
9090	Metrics/status listener	Serves the configured Prometheus scrape path and operational status routes such as /status/models. Self-hosted and managed gateway images bind this port by default when Prometheus metrics are enabled.	Keep private to Prometheus and your monitoring systems. Status routes on this listener do not require application authentication.
2379	etcd client listener	Stores dynamic gateway configuration for self-hosted deployments.	Keep private to AISIX and the systems that manage gateway configuration.

Configure Listener Ports

Set the proxy listener with proxy.addr:

proxy:
  addr: "0.0.0.0:3000"

Set the self-hosted admin listener with admin.addr:

admin:
  addr: "127.0.0.1:3001"

The proxy listener address is required in startup configuration. The admin listener defaults to 127.0.0.1:0, so self-hosted deployments must set admin.addr when they need the Admin API.

Set observability.metrics.prometheus.addr to change the dedicated metrics/status listener address. The listener runs when Prometheus metrics are enabled and defaults to 0.0.0.0:9090. The admin API never serves /metrics or the operational /status/* routes:

observability:
  metrics:
    prometheus:
      enabled: true
      path: "/metrics"
      addr: "0.0.0.0:9090"

The metrics/status listener also serves /status/config, /status/ready, and /status/models. These operational routes are not protected by the admin key. Bind the listener to a private interface or restrict it with network policy or firewall rules.