Every app calls one endpoint. Provider credentials remain on shortsblink.com.
Required headers identify the app and its installation. Each app has a separate revocable client key.
Authorization: Bearer llm_APP_KEY
X-App-Key: llm_APP_KEY
X-Bundle-ID: com.ai.example
X-Device-ID: app-generated-installation-uuid
X-Page: onboarding-result
X-User-ID: optional-pseudonymous-user-id
Content-Type: application/json{
"provider": "openai",
"operation": "text",
"model": "gpt-4.1-mini",
"input": "Translate this text",
"options": {"max_output_tokens": 800}
}{
"provider": "replicate",
"operation": "images.generate",
"model": "owner/model",
"input": {"prompt": "A calm bedroom"},
"options": {"wait_seconds": 60}
}Existing clients can keep their provider request and response formats while replacing only the host. Send the same app, bundle, installation and context headers shown above.
OpenAI: /llm/openai/v1/responses
Google: /llm/google/v1beta/models/{model}:generateContent
Replicate: /llm/replicate/v1/predictions
Anthropic: /llm/anthropic/v1/messagesFor generic Replicate prediction and polling calls, also send X-LLM-Model. The gateway preserves the provider response shape and signs the upstream request with the server credential.
| Provider | Operations | Server credential |
|---|---|---|
| OpenAI | text, responses, chat.completions, embeddings, images.generate, images.edit | OPENAI_API_KEY |
| Gemini | text, generateContent, multimodal | GEMINI_API_KEY or GOOGLE_API_KEY |
| Replicate | predict, text, images.generate, images.edit | REPLICATE_API_TOKEN |
| Anthropic | text, messages | ANTHROPIC_API_KEY |
Request and response JSON are encrypted at rest, provider credentials are redacted, and records expire after 90 days. The dashboard filters by app, installation, user, page, provider, model, status and date. Access can be stopped per installation or for the entire app.