Admin login
Password comes from ADMIN_PASSWORD.
v5 adds universal caps, per-device seats, allowlists, exports, invoice snapshots, Stripe top-ups, and stronger rate limiting.
Looking for an API key? Request a kAIxu API key →
Already have a key? Open User Dashboard →
Need the public fuel-and-asset hub? Open SkyeFuelStation →
Customers
| ID | Plan | Monthly cap | Active | Active keys | Netlify token | Created |
|---|
Click a customer row to prefill Customer ID for Keys/Usage.
Netlify token is stored encrypted in Netlify DB. KaixuPush will prefer the customer token; it falls back to NETLIFY_AUTH_TOKEN if unset.
Create customer + issue master key
Keys (Sub-keys / Rotate / Revoke)
| ID | Last4 | Label | Cap override | RPM override | Max devices | Require install | Allowed providers | Allowed models | Revoked | Created | Actions |
|---|
Create sub-key
Rotate = create a new key with same settings and revoke the old key. Revoke = immediate cutoff.
Usage
| Time | Provider | Model | Input | Output | Cost (cents) |
|---|
SSE endpoint: POST /.netlify/functions/gateway-stream
SkyeFuelStation
Station pricing policy
Gateway 13 reads the station from here without becoming the public front door.
Station products
Top customer usage
| Customer | Plan | Spent | Extra | Tokens |
|---|
Recent station activity
| Time | Customer | Provider | Model | Cost |
|---|
Platform Control
Load platform control to inspect which separate surfaces are connected to Gateway 13 and which ones are only linked by route.
Backup-brain status will appear here after loading platform control.
| Platform | Visibility | Storage | Summary | Health | Onboarding | Lifecycle | Owner / Notes | Updated | Launch / Save |
|---|
Billing & Controls
Customer policy
Top-ups
Manual top-ups credit extra_cents. Stripe checkout requires Stripe env vars + webhook.
Invoice snapshot
—
Devices
| Key | Install ID | First seen | Last seen | Revoked | User-Agent | Action |
|---|
Exports & Invoices
Downloads use your admin password header, so they fetch and save locally.
KaixuPush (Deploy Proxy)
Project registry
| ID | Project ID | Name | Netlify Site ID | Updated | Actions |
|---|
Tip: click a row to load into the form.
Deploy history
| Push ID | Project | Branch | State | Required | Uploaded | URL | Created |
|---|
Chunk jobs
| Push ID | Project | Path | SHA1 | Parts | Received | Staged bytes | Status | Updated |
|---|
Push invoices
| Month | Total | Pricing | Deploys | Bytes | Updated |
|---|
GitHub Push Gateway
Repositories
| Repo | Private | Default | Updated | Link |
|---|
Recent ZIP push jobs
| Job | Repo | Branch | Status | Bytes | Attempts | Updated | Result |
|---|
/.netlify/functions/github-oauth-start and /.netlify/functions/github-oauth-callback.
Git DB push pipeline endpoints: /gh-push-init, /gh-push-upload-chunk, /gh-push-upload-complete, /gh-push-status.
Embeddings Lane
Generate Embeddings
—
Semantic Search
Query your stored embeddings with natural language. The gateway embeds your query in real-time, performs cosine similarity against your collection, and returns the top-K matches.
| Rank | Score | Doc ID | Text (preview) | Metadata |
|---|
Collections
Manage your vector namespaces. Each collection is an isolated set of embeddings.
| Collection | Vectors | Dimensions | Model | Created | Last updated | Actions |
|---|
Manage documents
—
Bulk operations
Embeddings Usage
| Time | Operation | Provider | Model | Vectors | Tokens | Cost (cents) |
|---|
Architecture note: All embeddings are generated inside the gateway - your clients never call external embedding vendors directly. The gateway handles lane routing, token metering, vector storage (pgvector in Neon), and cosine similarity search. This is true semantic RAG: ingest -> embed -> store -> search, all through one authenticated endpoint with the same kx_live_… key.
Integration
Non-stream
POST /.netlify/functions/gateway-chat
Streaming (SSE)
POST /.netlify/functions/gateway-stream
Client opens EventSource-like stream via fetch and reads SSE frames (event/meta/delta/done).
Normalized chat request
{
"provider": "kaixu",
"model": "kaixu-chat",
"messages": [{"role":"user","content":"Hello"}],
"max_tokens": 256,
"temperature": 0.7
}
Embeddings — Generate & Store
POST /.netlify/functions/gateway-embed
{
"provider": "kaixu",
"model": "kaixu-embed-standard",
"input": ["First document", "Second document"],
"collection": "my-docs",
"store": true,
"doc_ids": ["doc-001", "doc-002"],
"metadata": {"source": "api"},
"dimensions": 1536
}
Set store: false to generate vectors without persisting. Omit doc_ids for auto-generated UUIDs. dimensions is optional (model default used).
Embeddings — Semantic Search
POST /.netlify/functions/gateway-embed-search
{
"query": "How do I reset my password?",
"collection": "my-docs",
"top_k": 5,
"threshold": 0.7,
"filter": {"category": "docs"}
}
The gateway embeds your query using the same model as the collection, then performs pgvector cosine similarity search. Results include doc_id, score, text, and metadata.
Embeddings — Collection Management
GET /.netlify/functions/gateway-embed-collections
GET /.netlify/functions/gateway-embed-collections?name=my-docs
DELETE /.netlify/functions/gateway-embed-collections?name=my-docs
List all collections, get stats for one, or purge an entire collection.
SSE events
event: meta
data: {"provider":"kAIxu","model":"kaixu-chat","month":{"month":"2026-02","cap_cents":2000,"spent_cents":0,"key_cap_cents":500,"key_spent_cents":12}}
event: delta
data: {"text":"Hel"}
event: delta
data: {"text":"lo!"}
event: done
data: {"usage":{"input_tokens":12,"output_tokens":18,"cost_cents":1},"month":{"month":"2026-02","cap_cents":2000,"spent_cents":1,"key_cap_cents":500,"key_spent_cents":13}}
This build is Netlify DB-native (Neon) and uses an in-house DB-backed rate limiter (no Redis required).
Monitor
| Time | Level | Function | App | Status | Provider/Model | ms | Request | Summary |
|---|
Platform Timeline
| Time | Source | Actor | Action | Target | Status | Summary |
|---|
Tip: tag your apps with headers x-kaixu-app and x-kaixu-build. For client-side errors (before the request hits the gateway), POST to /.netlify/functions/client-error-report.
📖 Admin Tutorial — How to Use kAIxU Gateway
This is your complete guide to running the gateway. Bookmark this tab.
⚡ How It Works
kAIxU Gateway is a metered AI proxy. You own the private lane credentials. Clients get kAIxu virtual keys (kx_live_…) that route through your gateway. You set spend caps, rate limits, and device seats. Clients pay you -> you pay infrastructure costs. The margin is yours.
All keys, usage, billing, and audit data live in Neon Postgres (via @netlify/neon). No Redis. No external services unless you add Stripe.
1. Customers Tab
What it shows: All registered customers — email, plan, monthly cap, active status, key count, and whether they have a Netlify token set (for KaixuPush).
How to use:
- Click Refresh to reload the list
- Click any row to select that customer — their ID auto-fills into the Keys, Usage, Billing, Devices, and Exports tabs
- Use Set Netlify token to store an encrypted deploy token for the selected customer (used by KaixuPush)
2. Create Customer + Master Key
What it does: Creates a new customer record AND immediately issues them a master API key.
Steps:
- Enter their email
- Set the plan name (e.g. "starter", "pro", "enterprise") — this is just a label
- Set the monthly cap in cents (2000 = $20/month spend limit)
- Click Create + Issue Master Key
- ⚠️ The raw key (
kx_live_…) appears once. Copy it immediately and send to the client. You cannot retrieve it later — only the hash is stored.
3. Keys (Sub-keys / Rotate / Revoke)
What it does: Manage all keys for a customer. Create sub-keys with custom limits, rotate compromised keys, or revoke access instantly.
Key concepts:
- Sub-keys inherit the customer's cap but can have their own overrides (lower cap, different RPM, restricted providers/models)
- Rotate = creates a new key with the same settings, revokes the old one. Use when a key is compromised
- Revoke = immediate cutoff. The key stops working instantly
- Cap override: If set, this key has its own separate spend cap (in cents) independent of the customer cap
- Allowed providers/models: Restrict which AI providers or specific models this key can access
- Max devices: How many unique install_ids can use this key simultaneously
4. Usage
What it shows: Detailed usage breakdown for a customer in a specific month — total cap, extra credits, amount spent, total tokens, and every individual API call.
How to use:
- Enter or select a Customer ID
- Set the month (YYYY-MM format, defaults to current)
- Click Load usage
The summary cards show Cap / Extra / Spent / Tokens. The table below shows every individual gateway call with provider, model, input/output tokens, and cost in cents.
5. Billing & Controls
Customer policy — change a customer's plan name, monthly cap, active status, device limits, provider/model allowlists. Click Save to apply.
Top-ups:
- Manual top-up: Adds extra_cents to the customer's balance for the current month (use when a client pays you directly)
- Stripe checkout: Creates a Stripe checkout session. Requires
STRIPE_SECRET_KEYandSTRIPE_WEBHOOK_SECRETenv vars
Invoice snapshots: Load or create a JSON invoice record for the month. Useful for record-keeping.
6. Devices
What it shows: Every unique device (install_id) that has used a customer's keys. Shows first-seen, last-seen, user-agent, and revocation status.
If a customer sets require_install_id = true, every request must include an x-install-id header. Devices are auto-registered up to max_devices_per_key. You can revoke individual devices here.
7. Exports & Invoices
Download CSV exports of usage data:
- Events CSV — every individual API call with timestamps, tokens, cost
- Summary CSV — aggregated monthly summary
- Invoice CSV — formatted for billing/accounting
Filter by customer, month, and optionally a specific key.
8. KaixuPush (Deploy Proxy)
What it is: A deployment pipeline that lets clients push sites to Netlify through your gateway. Each deploy is tracked, metered, and invoiced.
Workflow:
- Register a project — give it an ID, name, and the Netlify Site ID it deploys to
- Client pushes files via the chunked upload pipeline
- Track deploys in Deploy history and chunk uploads in Chunk jobs
- Generate invoices per month with Generate Invoice
The client's Netlify token (set in Customers tab) is used for deploys. If not set, falls back to your NETLIFY_AUTH_TOKEN.
9. GitHub Push
What it is: Push code to GitHub repositories through the gateway. Clients store their GitHub PAT (encrypted), and the gateway handles ZIP-based pushes to any branch.
Steps:
- Set PAT — save the client's GitHub personal access token (stored encrypted in DB)
- Load Repos — see all repos the token has access to
- Load Jobs — view recent ZIP push operations and their status
OAuth flow also available at /.netlify/functions/github-oauth-start.
10. Embeddings Lane (Semantic RAG)
What it is: A complete embeddings pipeline built into the gateway. Generate vector embeddings from any supported provider, store them in pgvector (Neon), and run semantic similarity search — all authenticated through the same kx_live_… key.
Why it matters: This is true semantic RAG. Your clients do not need separate vendor keys, a separate vector database, or a retrieval pipeline. Everything goes through one gateway with metered billing.
Workflow:
- Choose a lane + model (kaixu-embed-standard recommended for cost/performance)
- Paste or send text(s) → they get embedded and optionally stored in a collection
- Use Semantic Search to query your stored vectors with natural language
- Pipe search results into your chat completions for grounded, RAG-powered responses
Supported lanes:
- kAIxu Standard - kaixu-embed-standard (1536d), kaixu-embed-large (3072d), kaixu-embed-legacy (1536d)
- kAIxu Compact - kaixu-embed-compact (768d), kaixu-embed-compact-v2 (768d)
- kAIxu Performance - kaixu-embed-performance (1024d), kaixu-embed-lite (512d)
Collections: Each collection is a logical namespace. You can have "support-docs", "product-catalog", "knowledge-base", etc. Each tracks its model and dimensions so queries always use the right model.
11. Integration
Quick-reference for API endpoints and request/response formats. Share this with clients so they know how to call the gateway.
- Non-stream:
POST /.netlify/functions/gateway-chat— returns full response - Stream (SSE):
POST /.netlify/functions/gateway-stream— returns Server-Sent Events
Both endpoints accept the same normalized request body with provider, model, messages, max_tokens, temperature. Auth via Authorization: Bearer kx_live_… header.
12. Monitor
What it does: Real-time and historical view of gateway events — errors, warnings, rate-limited requests, slow responses, and audit entries.
How to use:
- Start Live — polls for new events every few seconds
- Filter by level (error/warn/info), kind, function name, app name, or request ID
- Click a row to see the full JSON payload in a modal
- Prune — delete old events to keep the table clean
Tip: have your clients tag requests with x-kaixu-app: MyApp so you can filter by app.
🔑 Quick Reference
| Item | Details |
|---|---|
| Key format | kx_live_ + 48 base64url chars (56 total) |
| Auth header | Authorization: Bearer kx_live_… |
| Admin auth | JWT from ADMIN_PASSWORD login (12h TTL) |
| Chat endpoint | POST /.netlify/functions/gateway-chat |
| Stream endpoint | POST /.netlify/functions/gateway-stream |
| Embed endpoint | POST /.netlify/functions/gateway-embed |
| Embed search | POST /.netlify/functions/gateway-embed-search |
| Collections | GET/DELETE /.netlify/functions/gateway-embed-collections |
| Vector storage | pgvector (Neon Postgres) — cosine similarity |
| Self-service keys | /request-key (public, no admin needed) |
| User dashboard | /gateway/dashboard.html |
| Health check | GET /.netlify/functions/health |
| Spend caps | Customer-level + per-key override (in cents) |
| Rate limits | RPM (per key) + RPD (optional) — DB-backed, no Redis |
| Device seats | max_devices_per_key with optional require_install_id |
| Chat lanes | kAIxu chat lanes (gateway-routed) |
| Embed lanes | kAIxu embed lanes (gateway-routed) |
| Env vars needed | ADMIN_PASSWORD, JWT_SECRET, and internal lane credentials managed server-side |
🚀 Typical Workflow (New Client)
- Go to Create tab → enter email, set plan + cap → click Create
- Copy the
kx_live_…key and send it to the client securely - Client adds
Authorization: Bearer kx_live_…to their API calls - Client hits
/.netlify/functions/gateway-chatorgateway-stream - Monitor usage in the Usage tab
- Adjust caps/limits in Billing & Controls as needed
- If a key is compromised → Keys tab → Rotate
- End of month → Exports tab → download invoice CSV
🤖 Self-Service Key Generator
Clients can request their own starter key at /request-key without needing you to be involved.
- They enter their email → get a
kx_live_…key instantly - Defaults: $20/month cap, 10 RPM, 3 max devices, starter plan
- Abuse guard: max 5 keys per email per hour
- If they already had a key, the old one is revoked and a new one issued
- You can customize defaults with
DEFAULT_SELFSERVE_*env vars
The client still shows up in your Customers tab. You can upgrade their plan, change caps, or issue sub-keys anytime.