Gateway System

An open protocol for proxying LLM requests—self-host your own gateway with your own keys

Open Gateway Protocol

The gateway protocol is open and anyone can run a gateway. Today you self-host your own gateway for full control over your data and infrastructure (bring your own provider keys). A hosted WebInfer Gateway is on the roadmap.

Gateways are optional—most users connect directly to providers via the browser extension or their own API keys. Gateways are useful when you want to provide AI access to website visitors without requiring them to configure anything.

Architecture Overview

Dev configures gateway with secret key + API keys

Dev generates access token locked to origin domain

User app sends requests with token for inference

Token-Origin Binding

Each access token is cryptographically bound to specific origins. When a request arrives:

1.Gateway extracts token: wlm-abc123.eyJ...

2.Verifies JWT signature with secret key

3.Checks Origin header against token's domains[]

4.Validates quota not exceeded

5.Proxies request to provider (OpenAI, Anthropic, etc.)

Allowed

Token domains: ["myapp.com", "*.myapp.com"]

Requests from myapp.com or staging.myapp.com

Rejected

Origin: evil-site.com

Token stolen and used from different domain

Protocol Discovery

WebInfer gateways expose a discovery endpoint that enables automatic configuration. Simply enter a gateway URL and WebInfer will fetch capabilities, endpoints, and auth requirements.

GET /.well-known/webinfer.json

Returns a machine-readable manifest following RFC 8615 conventions.

Add from URL

In Settings → Integrations, paste any gateway URL. WebInfer auto-discovers the configuration.

https://gateway.example.com

CLI Discovery

Add providers via command line with automatic discovery.

webinfer provider add https://gateway.example.com

Manifest includes:

• Provider name and description
• Available capabilities (chat, image, speech)
• Authentication requirements
• API endpoint paths
• Available models
• Setup instructions

Security Parameters

Quota Limits

Parameter	Options	Description
quota.type	`requests` \| `tokens`	Count API requests or LLM tokens consumed
quota.limit	number	Maximum allowed per period (e.g., 1000)
quota.period	`hour` \| `day` \| `month` \| `lifetime`	When quota resets

Domain Restrictions

Parameter	Example	Description
domains	`["myapp.com"]`	Exact domain match
domains	`["*.myapp.com"]`	Wildcard: any subdomain
domains	`[]` (empty)	Allow all origins (not recommended)

Token Expiration

Parameter	Type	Description
exp	Unix timestamp (ms)	Token expires after this time
expiresIn	milliseconds	Convenience: expires N ms from creation

Usage Example

server.ts

// Server-side: Generate token (NEVER expose secret key in browser)import { generateGatewayToken } from 'webinfer';const token = await generateGatewayToken({  secretKey: process.env.GATEWAY_SECRET_KEY,  gatewayId: 'abc123xyz456',  quota: {    type: 'requests',    limit: 1000,    period: 'month'  },  domains: ['myapp.com', '*.myapp.com'],  expiresIn: 30 * 24 * 60 * 60 * 1000, // 30 days  name: 'Production Token'});// Send token to client (safe to expose)

client.ts

// Client-side: Use token for requestsconst response = await fetch('https://gateway.webinfer.com/abc123xyz456', {  method: 'POST',  headers: {    'Content-Type': 'application/json',    'Authorization': 'Bearer wlm-abc123xyz456.eyJ...'  },  body: JSON.stringify({    messages: [{ role: 'user', content: 'Hello!' }]  })});const data = await response.json();