# Show HN: Phlox-GW – Open-source LLM gateway without the enterprise paywall

> Source: <https://robert-mcdermott.github.io/phlox-gw/>
> Published: 2026-07-13 20:16:14+00:00

Full-featured by default
## Everything between your users and your models

Publish model routes, control who can use them, attach prices, enforce budgets and rate limits,
and report usage for chargeback — from one admin console.

🔐

### Entra ID & OIDC SSO

Browser SSO with any OIDC identity provider. Auto-provisioning on first login, department claim mapping for chargeback, and group-based admin role mapping. Local accounts work too.

💰

### Cost accounting & chargeback

Per-user and per-department monthly chargeback from an append-only usage ledger, with per-model USD pricing per million tokens. CSV download for finance, JSON API for automation.

⛔

### Budgets with real enforcement

Monthly budgets per user, department, and API key with hard-limit enforcement — not just alerts. Burn-down views show spend, remaining budget, and projected month-end run rate.

⏱️

### Rate limits at every scope

RPM and TPM controls by user, department, provider, model, and API key. Blunt one noisy script without throttling the whole org.

🔀

### Smart routing & failover

Stable route aliases like `chat/default`

, ordered fallbacks, retries, per-attempt timeouts, health-aware routing, and weighted traffic splits — swap providers without touching clients.

🛡️

### Built-in guardrails

Detect emails, phone numbers, SSNs, credit cards, API keys, and custom regex patterns. Redact or block on input and output, with an admin preview tool for testing policies before saving.

🔑

### User-owned API keys

Self-service key minting, rotation, and expiration. Admin key inventory with per-key model allowlists, budgets, and rate limits.

📈

### Observability included

Operations dashboards for cost, tokens, requests, errors, and latency, plus Prometheus metrics and OpenTelemetry traces for your existing monitoring stack.

📜

### Immutable audit log

Every login, admin action, and API-key lifecycle event recorded with actor, target, details, and source IP.

🕵️

### Private by design

Request metadata search and CSV export without storing prompt text, response bodies, image bytes, tool contents, or secrets — by default.

🧪

### Admin playground

Send test chat messages through any model route to validate providers and models end to end — no API key required.

📦

### Signed config export

Ed25519-signed, sanitized configuration export for review, backup, and environment promotion — secrets and credentials never leave the box.