SkyeGateFS13 admin login
Password comes from ADMIN_PASSWORD.
This gate is the parent plane for auth, vendors, sovereign variables, usage metering, pushes, billing, and enterprise surface control.
Looking for access? Request a gate key →
Already have a key? Open User Dashboard →
Need the public fuel-and-asset hub? Open SkyeFuelStation →
Customers
| ID | Plan | Monthly cap | Active | Active keys | Netlify token | Created |
|---|
Click a customer row to prefill Customer ID for Keys/Usage.
Netlify token is stored encrypted in Netlify DB. SkyeGate Push prefers the customer token and falls back to NETLIFY_AUTH_TOKEN only when necessary.
Create customer + issue master key
Keys (Sub-keys / Rotate / Revoke)
| ID | Last4 | Label | Cap override | RPM override | Max devices | Require install | Allowed providers | Allowed models | Revoked | Created | Actions |
|---|
Create sub-key
Rotate = create a new key with same settings and revoke the old key. Revoke = immediate cutoff.
Ultimate Env Contract
This reflects the single canonical env.ultimate.template contract for SkyeHands, not a duplicate side sheet. The table is generated from that template, so updating the template updates this website map. Use npm run sync:env-website to leave a proof artifact after AI or operator edits.
| Section | Ownership | Variable | Configured |
|---|
Canonical env sheet: env.ultimate.template in this gate project.
Readable companion guide: ENV_ULTIMATE_READABLE.md
Usage
| Time | Provider | Model | Input | Output | Cost (cents) |
|---|
SSE endpoint: POST /.netlify/functions/gateway-stream
Pricing Catalog
This is the operator-facing rate-card view. It shows what is priced in pricing/pricing.json, what was actually used this month, and whether any usage ever escaped the priced catalog.
| Provider | Model | Input / 1M | Output / 1M | Calls | Month cost |
|---|
—
SkyeFuelStation
Station pricing policy
SkyeGateFS13 reads the station from here without becoming the public front door.
Station products
Top customer usage
| Customer | Plan | Spent | Extra | Tokens |
|---|
Recent station activity
| Time | Customer | Provider | Model | Cost |
|---|
Platform Control
Load platform control to inspect which separate surfaces are connected to SkyeGateFS13 and which ones are only linked by route.
Backup-brain status will appear here after loading platform control.
| Platform | Visibility | Storage | Summary | Health | Onboarding | Lifecycle | Owner / Notes | Updated | Launch / Save |
|---|
Local Platform Review Board
offlineRun the same-folder runtime to persist a local platform review queue inside SkyeGateFS13.
| Platform | Queue state | Checkpoint | Owner | Targets | Updated |
|---|
Local Platform Execution Board
offlineApproved platform surfaces can queue execution checkpoints inside the same-folder runtime.
| Platform | Execution state | Checkpoint | Owner | Targets | Updated |
|---|
Local Platform Dispatch Board
offlineCompleted execution items can move into downstream release with a persisted dispatch board.
| Platform | Dispatch state | Checkpoint | Owner | Targets | Updated |
|---|
Local Workflow Timeline
offlineThe gate audit trail should show review, execution, and dispatch events in one inspectable timeline.
| Platform | Category | Checkpoint | Detail | Recorded |
|---|
Vendors & Sovereign Vault
This is the parent ledger for vendor integrations and sovereign variables. Use platform-shared credentials when you want gate-owned testing and metered billing. Use customer-owned credentials when the customer brings their own vendor account but still routes through the gate for clearance, tracking, and charging.
Vendor registry
| Vendor | Category | Configured | Ops status | Credential mode | Linked vars | Env signals | Notes | Save |
|---|
Add / rotate sovereign variable
Sovereign variable ledger
| ID | Scope | Vendor | Variable | Mode | Billing | Last4 | Active | Updated | Notes | Action |
|---|
Billing & Controls
Customer policy
Top-ups
Manual top-ups credit extra_cents. Stripe checkout requires Stripe env vars + webhook.
Invoice snapshot
—
Devices
| Key | Install ID | First seen | Last seen | Revoked | User-Agent | Action |
|---|
Exports & Invoices
Downloads use your admin password header, so they fetch and save locally.
SkyeGate Push (Deploy Proxy)
Project registry
| ID | Project ID | Name | Netlify Site ID | Updated | Actions |
|---|
Tip: click a row to load into the form.
Deploy history
| Push ID | Project | Branch | State | Required | Uploaded | URL | Created |
|---|
Chunk jobs
| Push ID | Project | Path | SHA1 | Parts | Received | Staged bytes | Status | Updated |
|---|
Push invoices
| Month | Total | Pricing | Deploys | Bytes | Updated |
|---|
GitHub Push Gateway
Repositories
| Repo | Private | Default | Updated | Link |
|---|
Recent ZIP push jobs
| Job | Repo | Branch | Status | Bytes | Attempts | Updated | Result |
|---|
/.netlify/functions/github-oauth-start and /.netlify/functions/github-oauth-callback.
Git DB push pipeline endpoints: /gh-push-init, /gh-push-upload-chunk, /gh-push-upload-complete, /gh-push-status.
Embeddings Lane
Generate Embeddings
—
Semantic Search
Query your stored embeddings with natural language. The gateway embeds your query in real-time, performs cosine similarity against your collection, and returns the top-K matches.
| Rank | Score | Doc ID | Text (preview) | Metadata |
|---|
Collections
Manage your vector namespaces. Each collection is an isolated set of embeddings.
| Collection | Vectors | Dimensions | Model | Created | Last updated | Actions |
|---|
Manage documents
—
Bulk operations
Embeddings Usage
| Time | Operation | Provider | Model | Vectors | Tokens | Cost (cents) |
|---|
Architecture note: All embeddings are generated inside the gateway - your clients never call external embedding vendors directly. The gateway handles lane routing, token metering, vector storage (pgvector in Neon), and cosine similarity search. This is true semantic RAG: ingest -> embed -> store -> search, all through one authenticated endpoint with the same kx_live_… key.
Integration
Non-stream
POST /.netlify/functions/gateway-chat
Streaming (SSE)
POST /.netlify/functions/gateway-stream
Client opens EventSource-like stream via fetch and reads SSE frames (event/meta/delta/done).
Normalized chat request
{
"provider": "kaixu",
"model": "kaixu-chat",
"messages": [{"role":"user","content":"Hello"}],
"max_tokens": 256,
"temperature": 0.7
}
Embeddings — Generate & Store
POST /.netlify/functions/gateway-embed
{
"provider": "kaixu",
"model": "kaixu-embed-standard",
"input": ["First document", "Second document"],
"collection": "my-docs",
"store": true,
"doc_ids": ["doc-001", "doc-002"],
"metadata": {"source": "api"},
"dimensions": 1536
}
Set store: false to generate vectors without persisting. Omit doc_ids for auto-generated UUIDs. dimensions is optional (model default used).
Embeddings — Semantic Search
POST /.netlify/functions/gateway-embed-search
{
"query": "How do I reset my password?",
"collection": "my-docs",
"top_k": 5,
"threshold": 0.7,
"filter": {"category": "docs"}
}
The gateway embeds your query using the same model as the collection, then performs pgvector cosine similarity search. Results include doc_id, score, text, and metadata.
Embeddings — Collection Management
GET /.netlify/functions/gateway-embed-collections
GET /.netlify/functions/gateway-embed-collections?name=my-docs
DELETE /.netlify/functions/gateway-embed-collections?name=my-docs
List all collections, get stats for one, or purge an entire collection.
SSE events
event: meta
data: {"provider":"kAIxu","model":"kaixu-chat","month":{"month":"2026-02","cap_cents":2000,"spent_cents":0,"key_cap_cents":500,"key_spent_cents":12}}
event: delta
data: {"text":"Hel"}
event: delta
data: {"text":"lo!"}
event: done
data: {"usage":{"input_tokens":12,"output_tokens":18,"cost_cents":1},"month":{"month":"2026-02","cap_cents":2000,"spent_cents":1,"key_cap_cents":500,"key_spent_cents":13}}
This build is Netlify DB-native (Neon) and uses an in-house DB-backed rate limiter (no Redis required).
Monitor
| Time | Level | Function | App | Status | Provider/Model | ms | Request | Summary |
|---|
Platform Timeline
Load platform history to inspect mirrored auth, AI, push, billing, voice, workspace, and org-level gate events.
| Time | Source | Actor | Action | Target | Status | Summary |
|---|
Tip: tag your apps with headers x-kaixu-app and x-kaixu-build. For client-side errors (before the request hits the gateway), POST to /.netlify/functions/client-error-report.
📖 Admin Tutorial — How to Use SkyeGateFS13
This is your complete guide to running the gateway. Bookmark this tab.
⚡ How It Works
SkyeGateFS13 is a metered sovereign proxy. You own the private lane credentials, vendor posture, and clearance model. Clients get gate-issued keys that route through the parent gate so you can enforce auth, track vendors, meter usage, and keep the margin.
All keys, usage, billing, and audit data live in Neon Postgres (via @netlify/neon). No Redis. No external services unless you add Stripe.
1. Customers Tab
What it shows: All registered customers — email, plan, monthly cap, active status, key count, and whether they have a Netlify token set (for SkyeGate Push).
How to use:
- Click Refresh to reload the list
- Click any row to select that customer — their ID auto-fills into the Keys, Usage, Billing, Devices, and Exports tabs
- Use Set Netlify token to store an encrypted deploy token for the selected customer (used by SkyeGate Push)
2. Create Customer + Master Key
What it does: Creates a new customer record AND immediately issues them a master API key.
Steps:
- Enter their email
- Set the plan name (e.g. "starter", "pro", "enterprise") — this is just a label
- Set the monthly cap in cents (2000 = $20/month spend limit)
- Click Create + Issue Master Key
- ⚠️ The raw key (
kx_live_…) appears once. Copy it immediately and send to the client. You cannot retrieve it later — only the hash is stored.
3. Keys (Sub-keys / Rotate / Revoke)
What it does: Manage all keys for a customer. Create sub-keys with custom limits, rotate compromised keys, or revoke access instantly.
Key concepts:
- Sub-keys inherit the customer's cap but can have their own overrides (lower cap, different RPM, restricted providers/models)
- Rotate = creates a new key with the same settings, revokes the old one. Use when a key is compromised
- Revoke = immediate cutoff. The key stops working instantly
- Cap override: If set, this key has its own separate spend cap (in cents) independent of the customer cap
- Allowed providers/models: Restrict which AI providers or specific models this key can access
- Max devices: How many unique install_ids can use this key simultaneously
4. Usage
What it shows: Detailed usage breakdown for a customer in a specific month — total cap, extra credits, amount spent, total tokens, and every individual API call.
How to use:
- Enter or select a Customer ID
- Set the month (YYYY-MM format, defaults to current)
- Click Load usage
The summary cards show Cap / Extra / Spent / Tokens. The table below shows every individual gateway call with provider, model, input/output tokens, and cost in cents.
5. Billing & Controls
Customer policy — change a customer's plan name, monthly cap, active status, device limits, provider/model allowlists. Click Save to apply.
Top-ups:
- Manual top-up: Adds extra_cents to the customer's balance for the current month (use when a client pays you directly)
- Stripe checkout: Creates a Stripe checkout session. Requires
STRIPE_SECRET_KEYandSTRIPE_WEBHOOK_SECRETenv vars
Invoice snapshots: Load or create a JSON invoice record for the month. Useful for record-keeping.
6. Devices
What it shows: Every unique device (install_id) that has used a customer's keys. Shows first-seen, last-seen, user-agent, and revocation status.
If a customer sets require_install_id = true, every request must include an x-install-id header. Devices are auto-registered up to max_devices_per_key. You can revoke individual devices here.
7. Exports & Invoices
Download CSV exports of usage data:
- Events CSV — every individual API call with timestamps, tokens, cost
- Summary CSV — aggregated monthly summary
- Invoice CSV — formatted for billing/accounting
Filter by customer, month, and optionally a specific key.
8. SkyeGate Push (Deploy Proxy)
What it is: A deployment pipeline that lets clients push sites to Netlify through your gateway. Each deploy is tracked, metered, and invoiced.
Workflow:
- Register a project — give it an ID, name, and the Netlify Site ID it deploys to
- Client pushes files via the chunked upload pipeline
- Track deploys in Deploy history and chunk uploads in Chunk jobs
- Generate invoices per month with Generate Invoice
The client's Netlify token (set in Customers tab) is used for deploys. If not set, falls back to your NETLIFY_AUTH_TOKEN.
9. GitHub Push
What it is: Push code to GitHub repositories through the gateway. Clients store their GitHub PAT (encrypted), and the gateway handles ZIP-based pushes to any branch.
Steps:
- Set PAT — save the client's GitHub personal access token (stored encrypted in DB)
- Load Repos — see all repos the token has access to
- Load Jobs — view recent ZIP push operations and their status
OAuth flow also available at /.netlify/functions/github-oauth-start.
10. Embeddings Lane (Semantic RAG)
What it is: A complete embeddings pipeline built into the gateway. Generate vector embeddings from any supported provider, store them in pgvector (Neon), and run semantic similarity search — all authenticated through the same kx_live_… key.
Why it matters: This is true semantic RAG. Your clients do not need separate vendor keys, a separate vector database, or a retrieval pipeline. Everything goes through one gateway with metered billing.
Workflow:
- Choose a lane + model (kaixu-embed-standard recommended for cost/performance)
- Paste or send text(s) → they get embedded and optionally stored in a collection
- Use Semantic Search to query your stored vectors with natural language
- Pipe search results into your chat completions for grounded, RAG-powered responses
Supported lanes:
- kAIxu Standard - kaixu-embed-standard (1536d), kaixu-embed-large (3072d), kaixu-embed-legacy (1536d)
- kAIxu Compact - kaixu-embed-compact (768d), kaixu-embed-compact-v2 (768d)
- kAIxu Performance - kaixu-embed-performance (1024d), kaixu-embed-lite (512d)
Collections: Each collection is a logical namespace. You can have "support-docs", "product-catalog", "knowledge-base", etc. Each tracks its model and dimensions so queries always use the right model.
11. Integration
Quick-reference for API endpoints and request/response formats. Share this with clients so they know how to call the gateway.
- Non-stream:
POST /.netlify/functions/gateway-chat— returns full response - Stream (SSE):
POST /.netlify/functions/gateway-stream— returns Server-Sent Events
Both endpoints accept the same normalized request body with provider, model, messages, max_tokens, temperature. Auth via Authorization: Bearer kx_live_… header.
12. Monitor
What it does: Real-time and historical view of gateway events — errors, warnings, rate-limited requests, slow responses, and audit entries.
How to use:
- Start Live — polls for new events every few seconds
- Filter by level (error/warn/info), kind, function name, app name, or request ID
- Click a row to see the full JSON payload in a modal
- Prune — delete old events to keep the table clean
Tip: have your clients tag requests with x-kaixu-app: MyApp so you can filter by app.
🔑 Quick Reference
| Item | Details |
|---|---|
| Key format | kx_live_ + 48 base64url chars (56 total) |
| Auth header | Authorization: Bearer kx_live_… |
| Admin auth | JWT from ADMIN_PASSWORD login (12h TTL) |
| Chat endpoint | POST /.netlify/functions/gateway-chat |
| Stream endpoint | POST /.netlify/functions/gateway-stream |
| Embed endpoint | POST /.netlify/functions/gateway-embed |
| Embed search | POST /.netlify/functions/gateway-embed-search |
| Collections | GET/DELETE /.netlify/functions/gateway-embed-collections |
| Vector storage | pgvector (Neon Postgres) — cosine similarity |
| Self-service keys | /request-key (public, no admin needed) |
| User dashboard | /gateway/dashboard.html |
| Health check | GET /.netlify/functions/health |
| Spend caps | Customer-level + per-key override (in cents) |
| Rate limits | RPM (per key) + RPD (optional) — DB-backed, no Redis |
| Device seats | max_devices_per_key with optional require_install_id |
| Chat lanes | kAIxu chat lanes (gateway-routed) |
| Embed lanes | kAIxu embed lanes (gateway-routed) |
| Env vars needed | ADMIN_PASSWORD, JWT_SECRET, and internal lane credentials managed server-side |
🚀 Typical Workflow (New Client)
- Go to Create tab → enter email, set plan + cap → click Create
- Copy the
kx_live_…key and send it to the client securely - Client adds
Authorization: Bearer kx_live_…to their API calls - Client hits
/.netlify/functions/gateway-chatorgateway-stream - Monitor usage in the Usage tab
- Adjust caps/limits in Billing & Controls as needed
- If a key is compromised → Keys tab → Rotate
- End of month → Exports tab → download invoice CSV
🤖 Self-Service Key Generator
Clients can request their own starter key at /request-key without needing you to be involved.
- They enter their email → get a
kx_live_…key instantly - Defaults: $20/month cap, 10 RPM, 3 max devices, starter plan
- Abuse guard: max 5 keys per email per hour
- If they already had a key, the old one is revoked and a new one issued
- You can customize defaults with
DEFAULT_SELFSERVE_*env vars
The client still shows up in your Customers tab. You can upgrade their plan, change caps, or issue sub-keys anytime.