Every model request takes the route you set.

Qosway is a self-hosted gateway for Claude Code, Codex and any OpenAI-compatible client. It sits inside your network and decides, for each request, whether it may leave, whether it needs to, and which model should answer.

Request a demo Follow one request

Speaks OpenAI chat completions, OpenAI Responses and Anthropic Messages. Clients keep their own response shape.

Every response says how it got hereexample

X-Proxy-Cache:          MISS
X-Proxy-Original-Model: claude-opus
X-Proxy-Model:          deepseek-chat
X-Proxy-Provider:       deepseek
X-Proxy-Downgraded:     true

One request, seven stops

The order is the order in the code. A request can leave the line at any stop on the left of the provider; each exit returns a named error to the client.

1
Identify

Checks the client key and applies its rate limit.
- 401invalid_api_key
- 429rate_limit_error
2
Inspect

Scans the prompt for secrets before anything is cached or sent.
- 403egress_blocked
3
Reserve

Holds tokens against the key’s daily and monthly caps.
- 429quota_exceeded
4
Route

Picks the model from your routing policy and enabled providers.
- 403provider_disabled
5
Remember

Looks for the same question: exact match first, then semantic.
- Answered hereHIT-EXACT or HIT-SEMANTIC. No provider call.
Send

Calls the provider. Falls back on 429 and 5xx, streams as it arrives.
Record

Writes usage, cost, cache result and latency off the response path.

Four controls, set in the panel built into the binary

Defaults are meant to suit most companies on first start. Everything below can be changed without a redeploy.

Routing

The model a client asks for is a request, not an order.

Mode	What happens
Save default	Short everyday prompts on a premium model move to the cheapest enabled model. Technical, very long and tool-using prompts stay on the model requested.
Single provider	All traffic goes to one provider and model.
Balance	Weighted split across the providers you pick.
Prompt rules	Your own rules: match a pattern and a token range, name the model.
Incoming model	Use what the client sent.

OpenAI, Anthropic, DeepSeek and Grok are each one switch. Turn a provider off and it leaves every choice above. If a provider answers 429 or 5xx, the request moves to a fallback model.

Cache

A repeated question should not be paid for twice.

Exact

SHA-256

Hash of model, messages and tools, held in Redis. Same request, same answer.

Semantic

≥ 0.95

Cosine similarity on the last user message. 0.95 is the default threshold. Skipped when the request carries tools.

The cache is shared across the company, but a hit needs the same prior conversation, so one thread is never served as the answer to another.

Quotas and limits

Every key has a ceiling, and the ceiling is enforced before the provider is called.

Token caps: Daily and monthly per client key. Defaults apply to every key; per-key overrides take effect immediately.
Over the cap: HTTP 429 quota_exceeded, returned before the upstream call.
Rate limit: Fixed window per key, 600 requests a minute by default, counted in Redis.
Request size: Bodies above 10 MiB are refused with 413.
Visibility: Per-key usage, cost, cache results and request history in the panel; counters at /metrics.

Egress protection

Secrets stop at the gateway, before any cache or provider sees them.

Private keys
AWS access keys
GitHub tokens
Slack tokens
Stripe live keys
Google API keys
OpenAI and Anthropic keys
Database URLs with a password
Assigned passwords and API keys
JSON Web Tokens

All ten are on by default and each can be switched off. Add your own phrases or RE2 patterns, and an allow-list for exact values. A blocked request returns 403 egress_blocked with the rule name. The matched text is not logged, cached or returned. Names and email addresses are not blocked by default.

One binary, inside your network

No Node runtime, no separate database. You run a single static Go executable behind your own TLS reverse proxy, and point your tools at it.

Your network

Your clients

Claude Code
Codex
Any OpenAI-compatible client

Qosway

One Go binary, with the admin panel inside.

SQLitein its data directory Redisoptional, for cache and limits

Providers you enable

OpenAI, Anthropic, DeepSeek, Grok

License check

Verified at start, then re-checked every five minutes.

Closed by default: With no client key created, every request is rejected.
Licensed per customer: Each binary carries a license signed for one customer and will not start without a valid one.
Runs where you run things: As a systemd service or a container, with the TLS reverse proxy you already operate.
Operable: /healthz, /readyz and a Prometheus /metrics endpoint.
Degrades, doesn’t stop: If Redis goes down, the exact cache and rate limit switch off and traffic keeps flowing to the providers.
Outbound traffic, listed: The providers you enable and the license check. Semantic matching uses a local embedder unless an OpenAI key is configured; then embeddings go to OpenAI.

What it keeps, and where

Written down plainly, including the parts that are not encrypted.

Data	Where it lives	How it is handled
Provider keys, client keys, license key, admin password hash	SQLite settings	AES-GCM encrypted with a key file kept beside the database. Store that file separately from backups of the database.
Usage, cost and quota records	SQLite	Reference a key id, never the key. Events kept 90 days, daily buckets 35 days, monthly buckets 14 months, then pruned.
Blocked requests	SQLite	Time, key id and rule name only. The matched secret is never stored.
Cached answers	Redis (exact), SQLite (semantic)	Not encrypted. Exact entries hold full answers, so give Redis a password or TLS on a private network. The semantic cache holds answers and embeddings, not prompt text.
Data directory	Local disk	Directory mode 0700; databases and key file 0600.

Behaviours worth knowing

First run: the admin password is set from the same machine, or with a one-time token printed in the log.
Panel: repeated failed admin logins from one address are locked out for a growing time.
Streams: one that ends early is reported as an error and never cached.

What it does not do

It does not read meaning. Egress rules are patterns, and routing is rules, not a model judging your prompts.
It does not block personal data by default. In code tools that is mostly false alarms; add your own patterns if you need it.
It does not terminate TLS. Put it behind a reverse proxy, or bind it to loopback.

See the route your own traffic would take.

Tell us which clients and providers you run today, and which rules you would want on day one.

Request a demo hello@qosway.com