Option #1
Ship the key in the app
Anyone with a proxy tool extracts it in minutes. Your OpenAI bill becomes their OpenAI bill.
Insecure
Mobile AI security platform
Keep secrets out of your app. Ship AI features securely.
Gate/AI verifies devices with attestation, injects provider secrets server-side, and caps each user's token spend. No API keys in your binary—and none demanded from your users.
Your Mobile App
Secure Enclave key · App Attest / Play Integrity
Gate/AI
Verify · DPoP bind · Rate limit · Inject secret
Attestation
Verified
DPoP
Bound
Rate limit
12 / 500
Secret
Injected
AI Provider
OpenAI · Anthropic · Gemini · Custom
The real choice
Shipping AI in a mobile app without a backend forces a bad choice.
Mobile devs cope in one of two ways today. Both cost you users, money, or both.
Option #2
Make users bring their own key
BYOK turns your onboarding into “go create an OpenAI account, generate a key, paste it here.” Most users bounce. The ones who stay file support tickets when their key breaks—and they're already paying for the AI, so why pay you?
User-hostile
The option that didn't exist—until now
Option #3: Gate/AI
Your key stays server-side. Users just use the app. Per-device token budgets cap what any single user can cost you—the cost control BYOK promised, without exporting the work to your users.
Secure. And it converts.
The platform
A single control plane for AI security, usage, and spend.
Gate/AI pairs cryptographic trust with real spend controls. No custom backend, no overnight pager duty.
Device provenance
App Attest, Play Integrity, and DPoP are orchestrated so every request is tied to a real device and binary.
Runtime policy
Per-device and global rate limits, short-lived tokens, and usage budgets block abuse before it hits your AI bill.
Observability
Every call is recorded with context so you can debug, spot abuse, and watch spend from one simple dashboard.
Why now
Shipping secrets is no longer acceptable.
Reverse engineering tools expose API keys in minutes. Gate/AI hardens every call so you can roll out AI safely—even if you do not run your own backend.
- 1 Decompile your app once, replay requests forever. Gate/AI binds every request to device + nonce.
- 2 API providers throttle by key, not by device. We enforce both to cap runaway spend.
- 3 When something looks off, you need answers. We record every decision so you can see exactly what happened, and when.
- 4 BYOK onboarding kills activation. Every provider-key form is a checkout page for a product that isn't yours.
How Gate/AI responds
- Authenticate
- Device attestation + Secure Enclave key pair + DPoP per request.
- Authorize
- Inspect device posture, environment, and customer tier before tokens are minted.
- Audit
- Browse every request in the dashboard, or export CSVs when you need receipts.
Result
Secrets stay in the cloud. Attack surface shrinks to zero.
How it works
Secure AI in three steps.
01
Add the Gate/AI SDK
iOS, Android, and cross-platform SDKs drop into your app without a custom backend.
02
Authorize installs
Gate/AI verifies each install with attestation, provisions device-scoped keys, and issues DPoP-bound tokens.
03
Proxy AI traffic
Your app calls Gate/AI, we forward to OpenAI, Anthropic, or Gemini, and inject the secret on the fly.
Capabilities
Everything mobile teams need, nothing you have to host or manage.
Built for indie devs and small teams: every AI request visible in one place, with no infrastructure to stand up.
Adaptive rate limiting
Cap each device's daily tokens and requests. You control your AI spend without asking users to bring a key.
Multi-provider routing
Switch between OpenAI, Anthropic, Google Gemini, or custom LLMs without rebuilding your client.
Secrets never ship
API keys stay in Gate/AI. Tokens expire in minutes and are locked to a proven device.
Playback-safe logging
Structured logs redact payloads, but keep enough context to trace abuse and performance bottlenecks.
Attestation orchestration
We manage App Attest, Play Integrity, and the Secure Enclave/StrongBox lifecycle for you.
Zero ops
No servers to run, no key vault to configure, no pager. Ship your app and check the dashboard when you feel like it.
Friendly pricing for solo devs
Start in minutes for free. Upgrade when you need more devices—no sales call. All plans include zero-trust security and cloud-based key management.
Free
$0
USD
Per month
- 25 monthly devices
- 100 daily requests
- 1 gated service
- Basic analytics
Core
$4.99
$49.99
USD
Per month
Per year
- 200 monthly devices
- Unlimited daily requests
- 3 gated services
- Global rate limiting
- Basic analytics
Pro
$9.99
$99.99
USD
Per month
Per year
- 500 monthly devices
- Unlimited daily requests
- Unlimited gated services
- Global & device rate limiting
- Advanced analytics
Need more than 500 devices per month or want help designing your rollout? Let's talk.
FAQ
Frequently asked questions
Everything you need to know before shipping AI on mobile the right way.
-
A mobile AI gateway is a security and routing layer between your mobile app and AI providers. It keeps provider API keys out of your app, verifies devices, issues short-lived tokens, and enforces per-device policies so you can safely call LLM APIs from iOS and Android.
-
A regular AI gateway assumes trusted backend callers. A mobile AI gateway assumes untrusted clients, uses device attestation and sender-constrained tokens, and is designed so you don't need your own backend just to talk to AI providers.
-
For many apps, no. Gate/AI is designed so you can ship secure AI features from a purely client-side mobile app, while Gate/AI acts as the secure middle layer between your app and AI providers.
-
At a high level, 3 key security advances allow us to do this:
- A one-time device key-pair is created and stored in the Secure Enclave on iOS or StrongBox on Android. The private key never leaves the secure area and is never seen by the app. Attackers can't get a hold of it.
- Platform specific attestation services allows our server to prove an app install is real. App Attest on iOS and Play Integrity on Android.
- OAuth 2.0's Demonstrating Proof of Possession (DPoP). Every API call includes a lightweight, per-request proof signed by the device key. Gate/AI then verifies that the proof matches the token and the current request, blocking replays and off-device use.
-
BYOK feels like it solves security and cost in one move—you never hold the key, and users pay for their own usage. But look at what it costs you:
- Conversion. A provider-key form in onboarding is a wall. Most users don't have an API key, don't want one, and bounce instead of creating a developer account for someone else's platform.
- Support. Expired keys, rate-limited keys, wrongly-scoped keys—their key problems become your tickets.
- Monetization. Users who bring their own key are already paying for the AI. Converting them to a paid tier later means asking them to pay twice.
With Gate/AI you keep your own key server-side and cap each device's daily token and request usage. That's the cost control BYOK promised—without pushing the work onto your users.
We wrote up the full argument in BYOK Is User Hostile.
-
These are the number of unique monthly devices that will make a request through Gate/AI's proxy service. This is not the same as the TOTAL number of monthly devices your app has. Your app has to make a request to Gate/AI in order to count towards your usage.
For example:
- A device running your app makes one request to Gate/AI: that's considered 1 device towards your usage.
- Another device makes 100 requests to Gate/AI: that's considered 1 device towards your usage.
-
Yes, of course. We aren't going to nickel and dime you. Our overhead is around device verification. So that's how we are charging.
Ready to ship?
Ship AI that just works. No keys in the binary, no keys from your users.
Create a free workspace, invite your teammates, and plug Gate/AI into your mobile app before lunch.