Configuration

Overview

Ingate is a fully managed cloud service. All configuration is done through the Ingate Dashboard at app.ingateai.com or programmatically via the Management API. There are no config files to edit, no CLI flags to set, and no infrastructure to manage.

This page covers every configuration surface available in the dashboard, organized by section. Settings marked Enterprise require an Enterprise plan.

Providers

Configure your upstream LLM providers in Dashboard → Providers. Each provider defines a target API that Ingate proxies requests to.

Provider Settings

Adding a Provider

1. Navigate to Dashboard → Providers → Add Provider
2. Enter a name, base URL, and select an auth mode
3. If using API Key mode, paste your provider's API key
4. Optionally mark it as the default provider
5. Click Save

Once configured, route requests to the provider using the header:

curl https://api.ingateai.com/v1/chat/completions \
  -H "X-Ingate-Key: sk-ingate-your-key" \
  -H "X-Ingate-Provider: openai" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o-mini", "messages": [{"role": "user", "content": "Hello"}]}'

Team & Access

Manage your organization, team members, API keys, and permissions in Dashboard → Settings.

Organization Settings

• Org name & slug: display name and URL-safe identifier
• Plan: view your current plan (Free or Enterprise)
• Billing: manage payment methods and invoices (Enterprise)

Team Management

Invite team members by email. Each member is assigned a role that controls their access level across the dashboard and API.

API Key Management

Create and manage API keys in Dashboard → API Keys. Each key can be named, scoped to specific providers or models, and optionally assigned to an app.

• Create keys with descriptive names (e.g. "Production Backend", "Staging")
• Scope keys to limit access to specific providers or models
• Rotate keys with configurable overlap periods for zero-downtime rotation
• Revoke keys instantly. The change takes effect immediately

You can also manage keys programmatically. See Authentication for API details.

Rate Limiting

Configure per-key rate limits in Dashboard → API Keys → Rate Limits. Rate limits protect your upstream providers from excessive usage and help enforce fair access across teams and applications.

Settings

When a key exceeds its rate limit, Ingate returns a 429 Too Many Requests response with a Retry-After header:

{
  "error": "rate_limit_exceeded",
  "message": "Rate limit exceeded for this key",
  "retry_after_seconds": 12
}

Provider Fallback

Configure automatic provider fallback chains in Dashboard → Providers → Fallback. When a primary provider returns an error or times out, Ingate automatically retries the request with the next provider in the chain.

Settings

How It Works

1. A request targets the primary provider (e.g. openai)
2. The provider returns a triggering error (e.g. 503 Service Unavailable)
3. Ingate replays the request to the next provider in the fallback chain
4. The response includes an X-Ingate-Fallback: true header so you know fallback was used

Data Retention

Configure how long Ingate retains request logs, eval results, and analytics data in Dashboard → Settings → Data Retention.

Data older than the retention period is automatically purged. Enterprise customers can set retention per data type and choose to retain data indefinitely.

Webhooks

Configure webhook endpoints in Dashboard → Settings → Webhooks to receive real-time notifications when events occur in your Ingate organization.

Settings

Event Types

Webhook Payload

Each webhook delivery is a signed POST request with a JSON body:

{
  "id": "evt_abc123",
  "type": "request.completed",
  "timestamp": "2026-04-04T11:15:00Z",
  "org_id": "org_xyz",
  "data": {
    "request_id": "req_def456",
    "provider": "openai",
    "model": "gpt-4o-mini",
    "status": 200,
    "latency_ms": 842,
    "tokens_in": 52,
    "tokens_out": 128
  }
}

Verify webhook signatures using the X-Ingate-Signature header. The signature is an HMAC-SHA256 hex digest of the raw request body using your webhook secret.

import hmac
import hashlib

def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Budget Controls

Set spending limits per organization, app, or API key in Dashboard → Budgets. Budgets track estimated spend based on token usage and provider pricing.

Settings

When a hard limit is reached, proxied requests return 429 with a budget_exceeded error until the budget resets or the limit is raised.

Response Caching

Enable response caching in Dashboard → Settings → Caching to reduce latency and cost for repeated identical requests.

Settings

Caching applies only to deterministic requests (temperature: 0). Cached responses include an X-Cache: HIT header. Cache misses are forwarded to the upstream provider and the response is stored for subsequent requests.

PII Redaction

Configure automatic PII redaction rules in Dashboard → Settings → PII Redaction. When enabled, Ingate scans request and response bodies and redacts sensitive information before it reaches the upstream provider or is stored in logs.

Settings

Supported Entity Types

Bring Your Own Storage (BYOS)

Connect your own PostgreSQL database in Dashboard → Settings → Storage. With BYOS, all request logs, eval results, and analytics data are stored in your infrastructure instead of Ingate's hosted database.

Settings

Setup

1. Navigate to Dashboard → Settings → Storage
2. Enter your PostgreSQL connection URL
3. Click Test Connection: Ingate validates connectivity and permissions
4. Click Enable BYOS: Ingate runs migrations on your database and begins routing data

Configuration Summary

Quick reference for where to find each setting in the dashboard: