Sample data. Not a customer bill.

Run the gateway wizard

Planned

Enrollment token, docker run, Compose, Railway or Render template, or Helm; env builder, readiness check, hybrid or offline.

View

Self-hosted

$ docker compose up -d
gateway listening on :3002
$ curl http://localhost:3002/health
200
$ import OpenAI from "openai";
$ 
$ const client = new OpenAI({
$   baseURL: "http://localhost:3002/v1",
$   apiKey: process.env.PAREZEN_API_KEY, // pz_ key. Project and environment come from this key.
$   defaultHeaders: {
$     "X-Parezen-Route": "support-reply",
$     "X-Parezen-Task": "ticket_resolved",
$   },
$ });
$ 
$ await client.chat.completions.create({
$   model: "anthropic/claude-sonnet-4.5",
$   messages: [{ role: "user", content: "Summarise the latest customer ticket." }],
$ });

The default way to run Parezen

The gateway and its Postgres run on your servers, next to your app. Your provider keys, request logs and shadow tests stay there. Parezen Cloud keeps the dashboard, policies and the savings ledger, and syncs with your gateway over outbound HTTPS only. This wizard is sample data: no token is issued and no image is published yet.

Step 1
Get an enrollment token
Used once on first start. The gateway then registers its own signing key.
Step 2
Start the container
Docker, Compose, or a template in your own Railway or Render account. Point it at a Postgres you already run, or the bundled one.
Step 3
Change your base URL
Point the OpenAI SDK at your gateway, for example http://localhost:3002/v1. The first request shows on Get started.

Planned: plain HTTP on port 3002

The design terminates TLS at your load balancer. This repository does not terminate TLS, encrypt stored keys or rate-limit. There is no Redis. The image is not published.

Not yet accepting customer keys

Customer key intake is off.

Provider keys are entered in your own gateway or secrets manager, never in Parezen Cloud. The env preview shows illustrative secret paths.

Start here on a single server. The same env file is what the other options use.

.env

DATABASE_URL=postgres://USER:[email protected]:5432/parezen
MASTER_KEY_BASE64=c2FtcGxlLW1hc3Rlci1rZXktbm90LXJlYWw=
# Illustrative. Planned shape, not a real secret.
PAREZEN_LICENSE=parezen_license_sample
# Illustrative. The open-source gateway does not need a licence key.
OPENAI_API_KEY_SECRET=secret://harbour/openai
ANTHROPIC_API_KEY_SECRET=secret://harbour/anthropic
GOOGLE_API_KEY_SECRET=secret://harbour/google
# Illustrative. Hybrid enrolls once with this token, then syncs outbound only: signed rollups up, signed config down.
PAREZEN_SYNC=hybrid
PAREZEN_ENROLL_TOKEN=pz_enroll_harb
PAREZEN_HTTP_ADDR=:3002 # illustrative listen address
# Apps authenticate with PAREZEN_API_KEY from the environment.
# Postgres 15 or newer, 16 recommended. Parezen does not ship Postgres.

compose.yaml

# Planned shape. Illustrative image tag, not a published release. You bring Postgres. Parezen does not ship a database.
# compose.yaml. No Redis. No Postgres service. TLS terminates at the load balancer. Gateway plain HTTP :3002.
# The dashboard is Parezen Cloud. The enrollment token comes from Setup and is used once.
services:
  gateway:
    image: parezen/gateway:0.9.4 # illustrative tag, not a published release
    ports:
      - "3002:3002"
    environment:
      DATABASE_URL: postgres://USER:[email protected]:5432/parezen
      MASTER_KEY_BASE64: c2FtcGxlLW1hc3Rlci1rZXktbm90LXJlYWw=
      # Illustrative. Planned shape, not a real secret.
      PAREZEN_LICENSE: parezen_license_sample
      # Illustrative. The open-source gateway does not need a licence key.
      OPENAI_API_KEY_SECRET: secret://harbour/openai
      ANTHROPIC_API_KEY_SECRET: secret://harbour/anthropic
      GOOGLE_API_KEY_SECRET: secret://harbour/google
      # Illustrative. Hybrid enrolls once with this token, then syncs outbound only: signed rollups up, signed config down.
      PAREZEN_SYNC: hybrid
      PAREZEN_ENROLL_TOKEN: pz_enroll_harb
      PAREZEN_HTTP_ADDR: :3002 # illustrative listen address
      # Apps authenticate with PAREZEN_API_KEY from the environment.
      # Postgres 15 or newer, 16 recommended. Parezen does not ship Postgres.
# App base URL: http://localhost:3002/v1
# TLS terminates at your load balancer, for example https://gateway.internal/v1
# Apps authenticate with PAREZEN_API_KEY from the environment.

Names ending in _API_KEY_SECRET, plus PAREZEN_LICENSE, PAREZEN_SYNC, PAREZEN_ENROLL_TOKEN and PAREZEN_HTTP_ADDR, are illustrative. The image tag is illustrative too. These files are the planned shape, not a published release. Postgres is yours.

Your gateways appear on Deployments with version, health and sync status. Shadow tests run in your gateway on your keys; only scores come to Parezen Cloud.

Example only

Node

// Example only. Bypassed calls are not routed, recorded or budget-checked. Do not bypass a budget hard stop.
import OpenAI from "openai";

const viaParezen = new OpenAI({
  baseURL: "http://localhost:3002/v1",
  apiKey: process.env.PAREZEN_API_KEY,
  timeout: 10_000,
  maxRetries: 0,
});
const direct = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

export async function chat(params) {
  try {
    return await viaParezen.chat.completions.create(params);
  } catch (err) {
    const parezenDown = err instanceof OpenAI.APIConnectionError || (err.status ?? 0) >= 500;
    if (!parezenDown) throw err; // a 4xx, including a budget hard stop, must not be bypassed
    return direct.chat.completions.create(params);
  }
}

Python

# Example only. Bypassed calls are not routed, recorded or budget-checked. Do not bypass a budget hard stop.
import os
import openai
from openai import OpenAI

via_parezen = OpenAI(
    base_url="http://localhost:3002/v1",
    api_key=os.environ["PAREZEN_API_KEY"],
    timeout=10,
    max_retries=0,
)
direct = OpenAI(api_key=os.environ["OPENAI_API_KEY"])

def chat(**params):
    try:
        return via_parezen.chat.completions.create(**params)
    except (openai.APIConnectionError, openai.InternalServerError):
        return direct.chat.completions.create(**params)

Example only. Bypassed calls are not routed, recorded in the ledger or budget-checked. Do not bypass a 4xx. A budget hard stop must hold. Billing never returns an error on production traffic.

$ docker compose up -d gateway listening on :3002 $ curl http://localhost:3002/health 200 $ import OpenAI from "openai"; $ $ const client = new OpenAI({ $ baseURL: "http://localhost:3002/v1", $ apiKey: process.env.PAREZEN_API_KEY, // pz_ key. Project and environment come from this key. $ defaultHeaders: { $ "X-Parezen-Route": "support-reply", $ "X-Parezen-Task": "ticket_resolved", $ }, $ }); $ $ await client.chat.completions.create({ $ model: "anthropic/claude-sonnet-4.5", $ messages: [{ role: "user", content: "Summarise the latest customer ticket." }], $ });

DATABASE_URL=postgres://USER:[email protected]:5432/parezen MASTER_KEY_BASE64=c2FtcGxlLW1hc3Rlci1rZXktbm90LXJlYWw= # Illustrative. Planned shape, not a real secret. PAREZEN_LICENSE=parezen_license_sample # Illustrative. The open-source gateway does not need a licence key. OPENAI_API_KEY_SECRET=secret://harbour/openai ANTHROPIC_API_KEY_SECRET=secret://harbour/anthropic GOOGLE_API_KEY_SECRET=secret://harbour/google # Illustrative. Hybrid enrolls once with this token, then syncs outbound only: signed rollups up, signed config down. PAREZEN_SYNC=hybrid PAREZEN_ENROLL_TOKEN=pz_enroll_harb PAREZEN_HTTP_ADDR=:3002 # illustrative listen address # Apps authenticate with PAREZEN_API_KEY from the environment. # Postgres 15 or newer, 16 recommended. Parezen does not ship Postgres.

# Planned shape. Illustrative image tag, not a published release. You bring Postgres. Parezen does not ship a database. # compose.yaml. No Redis. No Postgres service. TLS terminates at the load balancer. Gateway plain HTTP :3002. # The dashboard is Parezen Cloud. The enrollment token comes from Setup and is used once. services: gateway: image: parezen/gateway:0.9.4 # illustrative tag, not a published release ports: - "3002:3002" environment: DATABASE_URL: postgres://USER:[email protected]:5432/parezen MASTER_KEY_BASE64: c2FtcGxlLW1hc3Rlci1rZXktbm90LXJlYWw= # Illustrative. Planned shape, not a real secret. PAREZEN_LICENSE: parezen_license_sample # Illustrative. The open-source gateway does not need a licence key. OPENAI_API_KEY_SECRET: secret://harbour/openai ANTHROPIC_API_KEY_SECRET: secret://harbour/anthropic GOOGLE_API_KEY_SECRET: secret://harbour/google # Illustrative. Hybrid enrolls once with this token, then syncs outbound only: signed rollups up, signed config down. PAREZEN_SYNC: hybrid PAREZEN_ENROLL_TOKEN: pz_enroll_harb PAREZEN_HTTP_ADDR: :3002 # illustrative listen address # Apps authenticate with PAREZEN_API_KEY from the environment. # Postgres 15 or newer, 16 recommended. Parezen does not ship Postgres. # App base URL: http://localhost:3002/v1 # TLS terminates at your load balancer, for example https://gateway.internal/v1 # Apps authenticate with PAREZEN_API_KEY from the environment.

// Example only. Bypassed calls are not routed, recorded or budget-checked. Do not bypass a budget hard stop. import OpenAI from "openai"; const viaParezen = new OpenAI({ baseURL: "http://localhost:3002/v1", apiKey: process.env.PAREZEN_API_KEY, timeout: 10_000, maxRetries: 0, }); const direct = new OpenAI({ apiKey: process.env.OPENAI_API_KEY }); export async function chat(params) { try { return await viaParezen.chat.completions.create(params); } catch (err) { const parezenDown = err instanceof OpenAI.APIConnectionError || (err.status ?? 0) >= 500; if (!parezenDown) throw err; // a 4xx, including a budget hard stop, must not be bypassed return direct.chat.completions.create(params); } }

# Example only. Bypassed calls are not routed, recorded or budget-checked. Do not bypass a budget hard stop. import os import openai from openai import OpenAI via_parezen = OpenAI( base_url="http://localhost:3002/v1", api_key=os.environ["PAREZEN_API_KEY"], timeout=10, max_retries=0, ) direct = OpenAI(api_key=os.environ["OPENAI_API_KEY"]) def chat(**params): try: return via_parezen.chat.completions.create(**params) except (openai.APIConnectionError, openai.InternalServerError): return direct.chat.completions.create(**params)