Skip to main content
This page is the field reference for every AI provider type. Type-specific defaults (URL, auth header, capabilities) live on each provider page. See AI Providers for what a provider is and how it attaches to a resource. Sidebar → AI Gateway → Providers → Create. After you save, the provider has tabs for General, Network, Models, Authentication, and Budget.

​
Capabilities

A capability is an API format the gateway will accept and proxy. The incoming request path selects a capability, and only attached providers that advertise that capability can handle the request. That is why Claude Code needs a provider with Anthropic Messages, and Codex needs a provider with OpenAI Chat Completions or Responses. Typed providers start with recommended capabilities. Custom providers need at least one selected. You can change capabilities later on the provider’s General tab. Select every format the upstream actually speaks. Custom providers can mix any combination. If two attached providers share a capability for the same model, the gateway picks one at request time. See Model Routing.

​
Auth Type

How the gateway authenticates to the upstream. Typed providers prefill the header that upstream expects. Bearer, x-api-key, x-goog-api-key, Cloudflare AI Gateway, and Splunk HEC all require an API key on the provider.

​
Routing

Where the gateway sends the request after it has selected this provider. If you choose Site Targets, configure the targets on the provider’s Network tab after you save. See Ollama, vLLM, Bifrost, and Cloud APIs Through a Site for Site Targets walkthroughs.

​
Models

Allow and block lists, inherit vs select, and provider selection are covered in Model Routing. Known Models, ownership scoring, and token pricing for budgets come from the Model Catalog.

​
Budget

The provider Budget tab caps estimated USD spend or token usage for every call that uses this provider. You can also set a budget on an individual allow-list model from the Models tab. See Budgets for scopes, periods, and the 429 clients receive when a cap is hit.

​
Headers and TLS

On Network you can also set:
  • Custom headers sent on every request to this provider (Header-Name: value, one per line)
  • Skip TLS verification for the upstream connection

​
Identity Headers

When Pangolin knows which user made the request, it forwards that identity to the upstream on every call: The user is known when:
  • A public resource is called with an identity key
  • A public resource is called with a manual key attributed to a user
  • A private AI Gateway resource is called from a connected Pangolin client, and that client maps to a user
An unattributed manual key still authenticates, but these headers are omitted. Empty values are omitted rather than sent blank. These are the same names as Forwarded Headers on HTTPS resources. A Custom upstream such as Bifrost can use them for downstream access control. They are sent in addition to any custom headers you configure on the provider.