AI Gateway

The AI Gateway is the control layer for AI in Skitflow. It lets Skitflow route AI features through a LiteLLM-compatible gateway, manage provider credentials centrally, attribute usage per organization, expose organization-scoped API keys, and provide a platform default model when you do not want every tenant to bring their own key.

It powers the AI Assistant, Ask AI actions, Compose analysis, Compose hardening, and external agent integrations that should use Skitflow's model catalog without copying provider secrets into every tool.

What the gateway does

• Routes models per feature — configure an organization default, then override the Assistant, Ask AI, or external agent routes when needed.
• Supports BYOK and platform defaults — use a tenant-owned provider, a platform-managed model, or automatic fallback.
• Keeps usage attributable — calls go through organization-scoped virtual keys so usage can be reported and governed.
• Centralizes API keys — provider secrets are stored server-side and are never returned to the UI.
• Exposes controlled agent access — AI Gateway API keys let approved agents and automations call the model catalog available inside Skitflow.
• Adds governance — operators can review usage and enforce budgets for platform-provided models.

Architecture

The gateway sits between Skitflow AI call sites and the actual model providers:

1. A user or approved agent invokes an AI feature, such as Assistant chat, Ask AI, Compose review, Compose hardening, or a gateway API call.
2. Skitflow resolves the route for the active organization and feature.
3. If AI Gateway is enabled and healthy, the request goes through the LiteLLM-compatible gateway.
4. The gateway uses an organization-scoped virtual key, then calls either a BYOK provider model or a platform default model.
5. Usage is attributed back to the organization and can be shown in the gateway usage views.

If the gateway is disabled, Skitflow uses the direct provider configuration path. If it is enabled but unavailable, AI features fail with a clear degraded-state error instead of waiting on a dead upstream.

Routing order

For each AI feature, Skitflow resolves the model in this order:

1. Feature override, for example Assistant or Ask AI.
2. Organization-wide default route.
3. The newest enabled BYOK provider for the organization.
4. Platform default chat model.
5. No model configured.

This keeps existing BYOK behavior intact while allowing operators to introduce platform-level defaults and per-feature routing gradually.

Gateway sections in the dashboard

AI Gateway includes these areas:

External agents

OpenClaw, Hermes Agent, internal scripts, and other custom agents can use Skitflow without carrying raw provider credentials. Create an AI Gateway API key, choose the models exposed to that organization, and let the agent call Skitflow as the governed model access point.

This keeps model access inside Skitflow: provider keys stay server-side, usage remains attributable, and teams can change the underlying provider or model without rewriting every agent integration.

Security and privacy

• Provider keys are write-only in the management API. The UI can show whether a key exists, not the key value.
• The gateway uses server-side routing decisions and organization-scoped keys for attribution.
• Assistant proposals do not execute automatically. Mutating actions require explicit confirmation and then re-run server-side authorization.
• Environment-variable diffs expose key names only, never secret values.