Last updated: July 24, 2026
Why gateways beat raw provider keys
Applications should never hold long-lived provider secrets for every microservice. A gateway centralizes identity, policy, and observability.
Without a gateway, every team invents retries, auth, and logging differently. With a gateway, platform teams set standards once. Kimss multiplexes chat and agentic flows through one authenticated edge mapped to vaulted provider endpoints per workspace.
See /docs/security_compliance and /enterprise-ai-control-plane for the broader control-plane pillar.
Kimss gateway responsibilities
AuthN/Z, governed-request enforcement, workspace routing, and attribution are first-class on the Kimss edge.
- Validate X-Kimss-Key or bearer tokens.
- Enforce RBAC and workspace membership.
- Deduct or check governed requests before/as traffic flows.
- Route to vaulted Connected Infrastructure.
- Record usage against agents and keys.
For internal MCP tools the gateway is dual-layer: application key, then SSO grants. See Trust Center.
Optional APIM layer
Azure API Management can front AI traffic for additional policies and diagnostic logs—when enabled and verified end-to-end.
Prefer Log Analytics gateway diagnostics for immutable audit trails over deprecated synchronous custom telemetry callbacks. Keep KIMSS_AI_USE_APIM_GATEWAY disabled in production until E2E checks pass in your environment.
Security posture lives in /trust and /docs/security_compliance.
Design checklist
Treat the gateway as production infrastructure: staging parity, key rotation, and clear failure modes when governed requests exhaust.
Document required headers, approved models, and escalation paths. Publish /docs/api_docs as the integrator contract—not production Swagger, which is disabled.
Frequently asked questions
OpenAI-compatible AI gateway — drop-in base_url swap for existing SDKs
Kimss is an OpenAI-compatible AI gateway: point existing SDKs at base_url https://api.kimss.ai with a Kimss key to get identity, audit, and spend controls without rewriting clients. See https://kimss.ai/python-sdk-mcp-quickstart.
What is an AI Agent Gateway and who provides a Zero-Trust LLM control plane?
Kimss provides an AI Agent Gateway as a Zero-Trust LLM control plane: identity at the edge, governed routing to your vaulted endpoints, kill switch, and gateway-verified audit—not a second model vendor. See https://kimss.ai/ai-gateway and https://kimss.ai/enterprise-ai-control-plane.
Is Kimss the same as Azure APIM?
No. Kimss is the product control plane and /v1 gateway. APIM is an optional Azure policy/audit layer in front of or alongside AI traffic.
Do we need APIM to use Kimss?
No. Many deployments use vaulted Connected Infrastructure with Kimss governance (APIM byo-proxy on the customer path).
What is an AI API gateway?
A specialized API gateway for LLM/agent traffic emphasizing auth, routing, metering, and safety policies.
Where should developers integrate?
Call Kimss /v1 with workspace credentials; see /docs/api_docs and /python-sdk-mcp-quickstart.