Self-hosting
Your Postgres and a one-time setup code. The open-source gateway needs no licence key.
Compose, then the app
Planned. The stack is the gateway and a local dashboard. The file is compose.yaml. The image name in the example is parezen/gateway. It is not published. Point DATABASE_URL at the Postgres you run. The design holds provider keys encrypted with MASTER_KEY_BASE64, plus the ledger and the cache. Encrypted key storage is not built. Do not put a production provider key in this setup. PAREZEN_LICENSE is illustrative. A dedicated Parezen project or key at each provider is part of the design. Read-only billing access is optional in the design. Redis is not required. The gateway is designed to serve plain HTTP. TLS is designed to end at your load balancer. This repository does not terminate TLS. Local base URL in the example: http://localhost:3002/v1. The gateway is not deployed. This repository does not call a model provider, does not read provider usage fields, does not terminate TLS, does not encrypt stored keys and does not rate-limit requests.
# Planned shape. Illustrative image tag, not a published release. You bring Postgres. Parezen does not ship a database.
# compose.yaml. No Redis. No Postgres service. TLS terminates at the load balancer. Gateway plain HTTP :3002.
# The dashboard is Parezen Cloud. The enrollment token comes from Setup and is used once.
services:
gateway:
image: parezen/gateway:0.9.4 # illustrative tag, not a published release
ports:
- "3002:3002"
environment:
DATABASE_URL: postgres://USER:[email protected]:5432/parezen
MASTER_KEY_BASE64: ${MASTER_KEY_BASE64}
# Illustrative. Planned shape, not a real secret.
PAREZEN_LICENSE: parezen_license_sample
# Illustrative. The open-source gateway does not need a licence key.
OPENAI_API_KEY_SECRET: secret://example/openai
ANTHROPIC_API_KEY_SECRET: secret://example/anthropic
GOOGLE_API_KEY_SECRET: secret://example/google
# Illustrative. Hybrid enrolls once with this token, then syncs outbound only: signed rollups up, signed config down.
PAREZEN_SYNC: hybrid
PAREZEN_ENROLL_TOKEN: pz_enroll_sample
PAREZEN_HTTP_ADDR: :3002 # illustrative listen address
# Apps authenticate with PAREZEN_API_KEY from the environment.
# Postgres 15 or newer, 16 recommended. Parezen does not ship Postgres.
# App base URL: http://localhost:3002/v1
# TLS terminates at your load balancer, for example https://gateway.internal/v1
# Apps authenticate with PAREZEN_API_KEY from the environment.
Names ending in _API_KEY_SECRET, plus PAREZEN_LICENSE, PAREZEN_SYNC, PAREZEN_ENROLL_TOKEN and PAREZEN_HTTP_ADDR, are illustrative. The image tag is illustrative too. These files are the planned shape, not a published release. Postgres is yours.
import OpenAI from "openai";
const client = new OpenAI({
baseURL: "http://localhost:3002/v1",
apiKey: process.env.PAREZEN_API_KEY, // pz_ key. Project and environment come from this key.
defaultHeaders: {
"X-Parezen-Route": "support-reply",
"X-Parezen-Task": "ticket_resolved",
},
});
await client.chat.completions.create({
model: "anthropic/claude-sonnet-4.5",
messages: [{ role: "user", content: "Summarise the latest customer ticket." }],
});
import os
from openai import OpenAI
client = OpenAI(
base_url="http://localhost:3002/v1",
api_key=os.environ["PAREZEN_API_KEY"], # pz_ key. Project and environment come from this key.
)
client.chat.completions.create(
model="anthropic/claude-sonnet-4.5",
messages=[{"role": "user", "content": "Summarise the latest customer ticket."}],
extra_headers={
"X-Parezen-Route": "support-reply",
"X-Parezen-Task": "ticket_resolved",
},
)
Optional per-request headers
// Optional per-request headers. The client still uses PAREZEN_API_KEY.
await client.chat.completions.create(
{
model: "anthropic/claude-sonnet-4.5",
messages: [{ role: "user", content: "Summarise the latest customer ticket." }],
},
{
headers: {
"X-Parezen-Trace": "trace_example",
"X-Parezen-Cache": "off",
},
},
);
# Optional per-request headers. The client still uses PAREZEN_API_KEY.
client.chat.completions.create(
model="anthropic/claude-sonnet-4.5",
messages=[{"role": "user", "content": "Summarise the latest customer ticket."}],
extra_headers={
"X-Parezen-Trace": "trace_example",
"X-Parezen-Cache": "off",
},
)
Default samples send X-Parezen-Route and X-Parezen-Task with defaultHeaders in Node or extra_headers in Python. Project and environment come from the pz_ key, not a header. Optional per-request headers are X-Parezen-Trace and X-Parezen-Cache: off. Self-hosted default is http://localhost:3002/v1. No-SDK snippets only work for apps already on the OpenAI format.
Helm
Planned
Helm is the same shape as Compose: your Postgres, not a database shipped by Parezen. Governance adds SSO and an audit log on paid bands. The values file includes the local dashboard. The image tag is illustrative.
# Planned shape. Illustrative image tag, not a published release. You bring Postgres. Parezen does not ship a database.
# values.yaml. No Redis. Postgres is yours (15+, 16 recommended), not a chart dependency.
# The gateway listens on plain HTTP :3002.
image:
repository: parezen/gateway
tag: "0.9.4" # illustrative tag, not a published release
service:
port: 3002
env:
DATABASE_URL: postgres://USER:[email protected]:5432/parezen
MASTER_KEY_BASE64: ${MASTER_KEY_BASE64}
# Illustrative. Planned shape, not a real secret.
PAREZEN_LICENSE: parezen_license_sample
# Illustrative. The open-source gateway does not need a licence key.
OPENAI_API_KEY_SECRET: secret://example/openai
ANTHROPIC_API_KEY_SECRET: secret://example/anthropic
GOOGLE_API_KEY_SECRET: secret://example/google
# Illustrative. Hybrid enrolls once with this token, then syncs outbound only: signed rollups up, signed config down.
PAREZEN_SYNC: hybrid
PAREZEN_ENROLL_TOKEN: pz_enroll_sample
PAREZEN_HTTP_ADDR: :3002 # illustrative listen address
# Apps authenticate with PAREZEN_API_KEY from the environment.
# Postgres 15 or newer, 16 recommended. Parezen does not ship Postgres.
postgresql:
enabled: false
redis:
enabled: false
dashboard:
enabled: false
# Local dashboard for offline installs only. Hybrid installs use the Parezen Cloud dashboard.
image:
repository: parezen/dashboard
tag: "0.9.4"
# Apps authenticate with PAREZEN_API_KEY from the environment.
Names ending in _API_KEY_SECRET, plus PAREZEN_LICENSE, PAREZEN_SYNC, PAREZEN_ENROLL_TOKEN and PAREZEN_HTTP_ADDR, are illustrative. The image tag is illustrative too. These files are the planned shape, not a published release. Postgres is yours.
Provider keys
Two paths, and neither accepts a production key on this website. This website does not store a provider key and does not call a secret manager. In the dashboard, a later gateway would encrypt a key at rest and show the last 4 characters. That storage is not enabled, traffic is not encrypted by the gateway, and there is no rate limit. In your own environment, in a cloud account or on-prem, the gateway would read PAREZEN_PROVIDER_OPENAI_KEY or a secret reference such asaws-secretsmanager:name, gcp-secretmanager:name or vault:name. The key would stay in that environment. The dashboard would learn which providers are connected and enabled, not the key. Fetching the secret is not built. The config can name the reference. Customer keys are refused until encryption in transit, encrypted key storage and rate limiting are all on.
# Parezen key for the gateway process. Not a provider key.
PAREZEN_API_KEY=parezen_license_sample
# This file is the env path a later gateway would use. It does not accept a production customer key.
# The gateway is not deployed. It has no encryption in transit, no encrypted key storage and no rate limits.
# A secret reference is a name only. This process does not fetch it.
PAREZEN_PROVIDER_OPENAI_KEY=sk-sample-not-a-real-key
PAREZEN_PROVIDER_ANTHROPIC_SECRET_REF=vault:secret/data/anthropicOffline and connected
Planned. Connected mode is designed to send signed monthly totals with the licence check-in: spend by provider and model, baseline cost, actual cost, verified savings and the bill-match result. Offline mode is designed to keep the detail on your network and still need a licence file. Prompt content is designed not to leave unless you turn on full prompt capture, which is a paid extra in the plan and off by default. Shadow tests that need prompts are designed to run inside your gateway. Offline and connected installs are not available.
Fail-open still lives in your app, aimed at http://localhost:3002/v1. Example only. Bypassed calls are not routed, recorded in the ledger or budget-checked. Do not bypass a 4xx. A budget hard stop must hold. Billing never returns an error on production traffic.